From: Al Viro <viro@zeniv.linux.org.uk>
To: Amit <amitchoudhary0523@gmail.com>
Cc: linux-kernel@vger.kernel.org
Subject: Re: Catching use-after-free easily in linux kernel.
Date: Tue, 11 Mar 2025 00:35:54 +0000 [thread overview]
Message-ID: <20250311003554.GN2023217@ZenIV> (raw)
In-Reply-To: <CAFf+5zj=KmBG0Avqy6cq9qtpGKR3HnYNc6rK6y8B_78Ajt4RhQ@mail.gmail.com>
On Mon, Mar 10, 2025 at 01:24:54PM +0530, Amit wrote:
> Hi,
>
> We can catch use-after-free easily if we do the following:
>
> kfree(x);
> (x) = NULL;
>
> Now, if someone uses 'x' again then the kernel will crash and we will know where
> the use-after-free is happening and then we can fix it.
That assumes that no pointer is ever stored in more than one place.
Which is very clearly false.
next prev parent reply other threads:[~2025-03-11 0:35 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-10 7:54 Catching use-after-free easily in linux kernel Amit
2025-03-11 0:35 ` Al Viro [this message]
2025-03-11 3:29 ` Amit
[not found] ` <CAFf+5zjGKMSCYNZvOzaCNRFKHjWe2a6TKmmKqg7Fe-TLQW07yA@mail.gmail.com>
2025-03-11 4:42 ` Al Viro
2025-03-11 4:53 ` Amit
2025-03-11 6:48 ` Amit
-- strict thread matches above, loose matches on Subject: below --
2026-01-13 12:03 Amit
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250311003554.GN2023217@ZenIV \
--to=viro@zeniv.linux.org.uk \
--cc=amitchoudhary0523@gmail.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox