Re: bpf: use-after-free in array_map_alloc

2016-05-24 Thread Alexei Starovoitov
On Tue, May 24, 2016 at 12:04 PM, Tejun Heo wrote: > Hello, > > Alexei, can you please verify this patch? Map extension got rolled > into balance work so that there's no sync issues between the two async > operations. tests look good. No uaf and basic bpf tests exercise per-cpu map are fine. >

Re: bpf: use-after-free in array_map_alloc

2016-05-24 Thread Tejun Heo
Hello, Alexei, can you please verify this patch? Map extension got rolled into balance work so that there's no sync issues between the two async operations. Thanks. Index: work/mm/percpu.c === --- work.orig/mm/percpu.c +++ work/mm/

Re: bpf: use-after-free in array_map_alloc

2016-05-24 Thread Tejun Heo
Hello, On Tue, May 24, 2016 at 10:40:54AM +0200, Vlastimil Babka wrote: > [+CC Marco who reported the CVE, forgot that earlier] > > On 05/23/2016 11:35 PM, Tejun Heo wrote: > > Hello, > > > > Can you please test whether this patch resolves the issue? While > > adding support for atomic allocati

Re: bpf: use-after-free in array_map_alloc

2016-05-24 Thread Vlastimil Babka
[+CC Marco who reported the CVE, forgot that earlier] On 05/23/2016 11:35 PM, Tejun Heo wrote: Hello, Can you please test whether this patch resolves the issue? While adding support for atomic allocations, I reduced alloc_mutex covered region too much. Thanks. Ugh, this makes the code even

Re: bpf: use-after-free in array_map_alloc

2016-05-23 Thread Alexei Starovoitov
On Mon, May 23, 2016 at 05:35:01PM -0400, Tejun Heo wrote: > Hello, > > Can you please test whether this patch resolves the issue? While > adding support for atomic allocations, I reduced alloc_mutex covered > region too much. after the patch the use-after-free is no longer seen. Tested-by: Alex

Re: bpf: use-after-free in array_map_alloc

2016-05-23 Thread Tejun Heo
Hello, Can you please test whether this patch resolves the issue? While adding support for atomic allocations, I reduced alloc_mutex covered region too much. Thanks. diff --git a/mm/percpu.c b/mm/percpu.c index 0c59684..bd2df70 100644 --- a/mm/percpu.c +++ b/mm/percpu.c @@ -162,7 +162,7 @@ stat

Re: bpf: use-after-free in array_map_alloc

2016-05-23 Thread Vlastimil Babka
On 05/23/2016 02:01 PM, Vlastimil Babka wrote: >> if I read the report correctly it's not about bpf, but rather points to >> the issue inside percpu logic. >> First __alloc_percpu_gfp() is called, then the memory is freed with >> free_percpu() which triggers async pcpu_balance_work and then >> pcpu

Re: bpf: use-after-free in array_map_alloc

2016-05-23 Thread Vlastimil Babka
[+CC Christoph, linux-mm] On 04/17/2016 07:29 PM, Alexei Starovoitov wrote: > On Sun, Apr 17, 2016 at 12:58:21PM -0400, Sasha Levin wrote: >> Hi all, >> >> I've hit the following while fuzzing with syzkaller inside a KVM tools guest >> running the latest -next kernel: > > thanks for the report. A

Re: bpf: use-after-free in array_map_alloc

2016-04-17 Thread Sasha Levin
On 04/17/2016 01:29 PM, Alexei Starovoitov wrote: > On Sun, Apr 17, 2016 at 12:58:21PM -0400, Sasha Levin wrote: >> > Hi all, >> > >> > I've hit the following while fuzzing with syzkaller inside a KVM tools >> > guest >> > running the latest -next kernel: > thanks for the report. Adding Tejun...

Re: bpf: use-after-free in array_map_alloc

2016-04-17 Thread Alexei Starovoitov
On Sun, Apr 17, 2016 at 12:58:21PM -0400, Sasha Levin wrote: > Hi all, > > I've hit the following while fuzzing with syzkaller inside a KVM tools guest > running the latest -next kernel: thanks for the report. Adding Tejun... if I read the report correctly it's not about bpf, but rather points to