Re: fs: use-after-free in path_lookupat

2017-05-30 Thread Dmitry Vyukov
On Tue, May 30, 2017 at 8:24 AM, Al Viro wrote: > On Mon, May 29, 2017 at 04:48:17PM +0200, Dmitry Vyukov wrote: > >> Al, do you want me to mail the patch? >> I won't be able to write a super detailed description, but I can do >> some format patch. > > It's been fixed by commit c0eb027e5aef7; if y

Re: fs: use-after-free in path_lookupat

2017-05-29 Thread Al Viro
On Mon, May 29, 2017 at 04:48:17PM +0200, Dmitry Vyukov wrote: > Al, do you want me to mail the patch? > I won't be able to write a super detailed description, but I can do > some format patch. It's been fixed by commit c0eb027e5aef7; if you are still able to trigger it on the current mainline, p

Re: fs: use-after-free in path_lookupat

2017-05-29 Thread Dmitry Vyukov
On Fri, Apr 28, 2017 at 8:19 AM, Dmitry Vyukov wrote: > On Thu, Mar 23, 2017 at 3:17 PM, Dmitry Vyukov wrote: >> On Sun, Mar 5, 2017 at 8:18 PM, Al Viro wrote: >>> On Sun, Mar 05, 2017 at 06:33:18PM +0100, Dmitry Vyukov wrote: >>> Added more debug output. name_to_handle_at(r4, &(0

Re: fs: use-after-free in path_lookupat

2017-04-27 Thread Dmitry Vyukov
On Thu, Mar 23, 2017 at 3:17 PM, Dmitry Vyukov wrote: > On Sun, Mar 5, 2017 at 8:18 PM, Al Viro wrote: >> On Sun, Mar 05, 2017 at 06:33:18PM +0100, Dmitry Vyukov wrote: >> >>> Added more debug output. >>> >>> name_to_handle_at(r4, &(0x7f003000-0x6)="2e2f62757300", >>> &(0x7f003000-0xd)={0

Re: fs: use-after-free in path_lookupat

2017-03-23 Thread Dmitry Vyukov
On Sun, Mar 5, 2017 at 8:18 PM, Al Viro wrote: > On Sun, Mar 05, 2017 at 06:33:18PM +0100, Dmitry Vyukov wrote: > >> Added more debug output. >> >> name_to_handle_at(r4, &(0x7f003000-0x6)="2e2f62757300", >> &(0x7f003000-0xd)={0xc, 0x0, "cd21"}, &(0x7f002000)=0x0, >> 0x1000) >> >> actua

Re: fs: use-after-free in path_lookupat

2017-03-06 Thread Dmitry Vyukov
On Sun, Mar 5, 2017 at 8:18 PM, Al Viro wrote: > On Sun, Mar 05, 2017 at 06:33:18PM +0100, Dmitry Vyukov wrote: > >> Added more debug output. >> >> name_to_handle_at(r4, &(0x7f003000-0x6)="2e2f62757300", >> &(0x7f003000-0xd)={0xc, 0x0, "cd21"}, &(0x7f002000)=0x0, >> 0x1000) >> >> actua

Re: fs: use-after-free in path_lookupat

2017-03-05 Thread Al Viro
On Sun, Mar 05, 2017 at 06:33:18PM +0100, Dmitry Vyukov wrote: > Added more debug output. > > name_to_handle_at(r4, &(0x7f003000-0x6)="2e2f62757300", > &(0x7f003000-0xd)={0xc, 0x0, "cd21"}, &(0x7f002000)=0x0, > 0x1000) > > actually passes name="" because of the overlapping addresses.

Re: fs: use-after-free in path_lookupat

2017-03-05 Thread Al Viro
On Sun, Mar 05, 2017 at 12:37:13PM +0100, Dmitry Vyukov wrote: > I am pretty sure it is that one. > I don't think I ever used name_to_handle_at syscall in my life and I > definitely didn't make it lookup a memfd :) So what does it normally return? On the runs where we do not hit that use-after-f

Re: fs: use-after-free in path_lookupat

2017-03-05 Thread Dmitry Vyukov
On Sun, Mar 5, 2017 at 6:33 PM, Dmitry Vyukov wrote: > On Sun, Mar 5, 2017 at 5:33 PM, Al Viro wrote: >> On Sun, Mar 05, 2017 at 05:14:23PM +0100, Dmitry Vyukov wrote: >>> On Sun, Mar 5, 2017 at 4:57 PM, Al Viro wrote: >>> > On Sun, Mar 05, 2017 at 12:37:13PM +0100, Dmitry Vyukov wrote: >>> > >>

Re: fs: use-after-free in path_lookupat

2017-03-05 Thread Dmitry Vyukov
On Sun, Mar 5, 2017 at 5:33 PM, Al Viro wrote: > On Sun, Mar 05, 2017 at 05:14:23PM +0100, Dmitry Vyukov wrote: >> On Sun, Mar 5, 2017 at 4:57 PM, Al Viro wrote: >> > On Sun, Mar 05, 2017 at 12:37:13PM +0100, Dmitry Vyukov wrote: >> > >> >> I am pretty sure it is that one. >> >> I don't think I e

Re: fs: use-after-free in path_lookupat

2017-03-05 Thread Al Viro
On Sun, Mar 05, 2017 at 05:14:23PM +0100, Dmitry Vyukov wrote: > On Sun, Mar 5, 2017 at 4:57 PM, Al Viro wrote: > > On Sun, Mar 05, 2017 at 12:37:13PM +0100, Dmitry Vyukov wrote: > > > >> I am pretty sure it is that one. > >> I don't think I ever used name_to_handle_at syscall in my life and I > >

Re: fs: use-after-free in path_lookupat

2017-03-05 Thread Dmitry Vyukov
On Sun, Mar 5, 2017 at 4:57 PM, Al Viro wrote: > On Sun, Mar 05, 2017 at 12:37:13PM +0100, Dmitry Vyukov wrote: > >> I am pretty sure it is that one. >> I don't think I ever used name_to_handle_at syscall in my life and I >> definitely didn't make it lookup a memfd :) > > So what does it normally

Re: fs: use-after-free in path_lookupat

2017-03-05 Thread Dmitry Vyukov
On Sun, Mar 5, 2017 at 12:24 PM, Dmitry Vyukov wrote: On Sat, Mar 04, 2017 at 03:59:36PM +0100, Dmitry Vyukov wrote: > I am getting the following use-after-free reports while running > syzkaller fuzzer on 86292b33d4b79ee03e2f43ea0381ef85f077c760 (but also > happened on 6dc39c

Re: fs: use-after-free in path_lookupat

2017-03-05 Thread Dmitry Vyukov
On Sun, Mar 5, 2017 at 12:15 PM, Dmitry Vyukov wrote: > On Sat, Mar 4, 2017 at 8:39 PM, Al Viro wrote: >> On Sat, Mar 04, 2017 at 03:59:36PM +0100, Dmitry Vyukov wrote: >> >>> I am getting the following use-after-free reports while running >>> syzkaller fuzzer on 86292b33d4b79ee03e2f43ea0381ef85f

Re: fs: use-after-free in path_lookupat

2017-03-05 Thread Dmitry Vyukov
On Sun, Mar 5, 2017 at 12:20 PM, Dmitry Vyukov wrote: > On Sun, Mar 5, 2017 at 12:15 PM, Dmitry Vyukov wrote: >> On Sat, Mar 4, 2017 at 8:39 PM, Al Viro wrote: >>> On Sat, Mar 04, 2017 at 03:59:36PM +0100, Dmitry Vyukov wrote: >>> I am getting the following use-after-free reports while runn

Re: fs: use-after-free in path_lookupat

2017-03-05 Thread Dmitry Vyukov
On Sat, Mar 4, 2017 at 8:39 PM, Al Viro wrote: > On Sat, Mar 04, 2017 at 03:59:36PM +0100, Dmitry Vyukov wrote: > >> I am getting the following use-after-free reports while running >> syzkaller fuzzer on 86292b33d4b79ee03e2f43ea0381ef85f077c760 (but also >> happened on 6dc39c50e4aeb769c8ae06edf2b1

Re: fs: use-after-free in path_lookupat

2017-03-04 Thread Al Viro
On Sat, Mar 04, 2017 at 03:59:36PM +0100, Dmitry Vyukov wrote: > I am getting the following use-after-free reports while running > syzkaller fuzzer on 86292b33d4b79ee03e2f43ea0381ef85f077c760 (but also > happened on 6dc39c50e4aeb769c8ae06edf2b1a732f3490913 and > c82be9d2244aacea9851c86f4fb74694c99

fs: use-after-free in path_lookupat

2017-03-04 Thread Dmitry Vyukov
Hello, I am getting the following use-after-free reports while running syzkaller fuzzer on 86292b33d4b79ee03e2f43ea0381ef85f077c760 (but also happened on 6dc39c50e4aeb769c8ae06edf2b1a732f3490913 and c82be9d2244aacea9851c86f4fb74694c99cd874). ===