From: Luis Chamberlain <mcgrof@kernel.org>
To: lyl2019@mail.ustc.edu.cn
Cc: linux-kernel@vger.kernel.org
Subject: Re: Re: Re: [PATCH] lib/test_kmod: Fix a use after free in register_test_dev_kmod
Date: Thu, 11 Mar 2021 14:46:45 +0000 [thread overview]
Message-ID: <20210311144645.GU4332@42.do-not-panic.com> (raw)
In-Reply-To: <7c27e8b5.cf02.17821bb6891.Coremail.lyl2019@mail.ustc.edu.cn>
On Thu, Mar 11, 2021 at 10:40:33PM +0800, lyl2019@mail.ustc.edu.cn wrote:
> So, register_test_dev_kmod() will return a valid and freed test_dev, and cause use after free
> in function test_kmod_init().
Without looking at the details, in trying to improve the commit log
further:
Is there a way you can reproduce a real world UAF and crash? If not why not?
What is the risk of not merging this commit into the kernel tree. This
information is useful for folks to evaluate whether or not users of this
module might want to merge this and/or backport it into their testing
kernel.
If chances of this happening are 0, then this just a theoretical issue.
Luis
prev parent reply other threads:[~2021-03-11 14:47 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-11 8:02 [PATCH] lib/test_kmod: Fix a use after free in register_test_dev_kmod Lv Yunlong
2021-03-11 13:01 ` Luis Chamberlain
2021-03-11 13:31 ` lyl2019
2021-03-11 13:58 ` Luis Chamberlain
2021-03-11 14:40 ` lyl2019
2021-03-11 14:46 ` Luis Chamberlain [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210311144645.GU4332@42.do-not-panic.com \
--to=mcgrof@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lyl2019@mail.ustc.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox