From: Gao Xiang <xiang@kernel.org>
To: Michael Bommarito <michael.bommarito@gmail.com>
Cc: Gao Xiang <xiang@kernel.org>, Sasha Levin <sashal@kernel.org>,
stable@vger.kernel.org, Chao Yu <chao@kernel.org>,
linux-erofs@lists.ozlabs.org
Subject: Re: Patch "erofs: remove fscache backend entirely" has been added to the 6.18-stable tree
Date: Tue, 13 Oct 2026 13:22:28 +0200 [thread overview]
Message-ID: <as4UdEWzIr2O_M31@MacBookPro> (raw)
In-Reply-To: <20261013111011.2814836-1-michael.bommarito@gmail.com>
Hi Michael,
On Tue, Oct 13, 2026 at 07:10:11AM -0400, Michael Bommarito wrote:
> For context, the original bug I found can hit both 100% deterministic
> local DoS and a textbook UAF on kmalloc-128 slab that requires timing,
> but I don't think an LPE can be ruled out...
>
> Since it is reachable by an ordinary read() on Nydus or others that
> enabled ondemand in Kconfig, I think it is worth thinking about what to
> do for all of the pre-deprecation users (even if it's just comms).
>
> I would defer to Gao, but I sent a minimal fix in June that can
> close the UAF without any other breaking changes.
Do you mean this one?
https://lore.kernel.org/r/20260619135800.1594811-1-michael.bommarito@gmail.com
As I requested months ago, could you please provide a reproducer first
so I can play with your patch.
If you provide a minimal reproducer, of course we could address this in
the stable kernels.
Thanks,
Gao Xiang
>
> Thanks,
> Michael Bommarito
>
prev parent reply other threads:[~2026-10-13 11:22 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20261013020044.2527207-1-sashal@kernel.org>
2026-10-13 7:28 ` Patch "erofs: remove fscache backend entirely" has been added to the 6.18-stable tree Gao Xiang
2026-10-13 7:59 ` Greg KH
2026-10-13 8:16 ` Gao Xiang
2026-10-13 10:37 ` Greg KH
2026-10-13 11:30 ` Gao Xiang
2026-10-13 11:10 ` Michael Bommarito
2026-10-13 11:22 ` Gao Xiang [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=as4UdEWzIr2O_M31@MacBookPro \
--to=xiang@kernel.org \
--cc=chao@kernel.org \
--cc=linux-erofs@lists.ozlabs.org \
--cc=michael.bommarito@gmail.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox