From: Eric Biggers <ebiggers@kernel.org>
To: Siddh Raman Pant <code@siddh.me>
Cc: David Howells <dhowells@redhat.com>,
Christophe JAILLET <christophe.jaillet@wanadoo.fr>,
Eric Dumazet <edumazet@google.com>,
"Fabio M. De Francesco" <fmdefrancesco@gmail.com>,
linux-security-modules <linux-security-module@vger.kernel.org>,
linux-kernel <linux-kernel@vger.kernel.org>,
linux-kernel-mentees
<linux-kernel-mentees@lists.linuxfoundation.org>,
syzbot+c70d87ac1d001f29a058
<syzbot+c70d87ac1d001f29a058@syzkaller.appspotmail.com>
Subject: Re: [PATCH v3] kernel/watch_queue: Make pipe NULL while clearing watch_queue
Date: Tue, 2 Aug 2022 22:41:31 -0700 [thread overview]
Message-ID: <YuoKi0GigXm/Hcb+@sol.localdomain> (raw)
In-Reply-To: <182621f8dca.1e0e6161130907.1470656861897824669@siddh.me>
On Wed, Aug 03, 2022 at 10:43:31AM +0530, Siddh Raman Pant wrote:
> On Wed, 03 Aug 2022 09:42:28 +0530 Eric Biggers <ebiggers@kernel.org> wrote:
> > Under what circumstances is the pipe pointer still being dereferenced after the
> > pipe has been freed? I don't see how it can be; see my explanation above.
>
> It really didn't fix the crash. It caused the same crash reported here, which
> I was already locally getting:
> https://syzkaller.appspot.com/bug?extid=03d7b43290037d1f87ca
I tested the syzbot reproducer
https://syzkaller.appspot.com/text?tag=ReproC&x=174ea97e080000, and it does
*not* trigger the bug on the latest upstream. But, it does trigger the bug if I
recent Linus's recent watch_queue fixes.
So I don't currently see any evidence of an unfixed bug. If, nevertheless, you
believe that a bug is still unfixed, then please provide a reproducer and a fix
patch that clearly explains what it is fixing.
> There is a null check in post_one_notification for the pipe, most probably
> because it *expects* the pointer to be NULL'd. Also, there is no reason to have
> a dangling pointer stay, it's just a recipe for further bugs.
If you want to send a patch or patches to clean up the code, that is fine, but
please make it super clear what is a cleanup and what is a fix.
- Eric
next prev parent reply other threads:[~2022-08-03 5:41 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-28 15:51 [PATCH v3] kernel/watch_queue: Make pipe NULL while clearing watch_queue Siddh Raman Pant
2022-08-01 9:34 ` Siddh Raman Pant
2022-08-01 10:24 ` Greg KH
2022-08-01 12:58 ` Siddh Raman Pant
2022-08-01 13:00 ` Siddh Raman Pant
2022-08-01 16:16 ` Dipanjan Das
2022-08-01 18:49 ` Siddh Raman Pant
2022-08-03 1:16 ` Eric Biggers
2022-08-03 3:58 ` Siddh Raman Pant
2022-08-03 4:10 ` Dipanjan Das
2022-08-03 1:08 ` Eric Biggers
2022-08-03 3:56 ` Siddh Raman Pant
2022-08-03 4:12 ` Eric Biggers
2022-08-03 5:13 ` Siddh Raman Pant
2022-08-03 5:41 ` Eric Biggers [this message]
2022-08-03 8:40 ` Siddh Raman Pant
2022-08-03 18:15 ` Eric Biggers
2022-08-04 8:39 ` Siddh Raman Pant
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YuoKi0GigXm/Hcb+@sol.localdomain \
--to=ebiggers@kernel.org \
--cc=christophe.jaillet@wanadoo.fr \
--cc=code@siddh.me \
--cc=dhowells@redhat.com \
--cc=edumazet@google.com \
--cc=fmdefrancesco@gmail.com \
--cc=linux-kernel-mentees@lists.linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=syzbot+c70d87ac1d001f29a058@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).