Re: [PATCH] fs/seq_file.c: Fix a UAF vulnerability in seq_release()

2019-07-10 Thread Alexander Duyck
On Wed, Jul 10, 2019 at 3:26 AM bsauce wrote: > > In seq_release(), 'm->buf' points to a chunk. It is freed but not cleared to > null right away. It can be reused by seq_read() or srm_env_proc_write(). > For example, /arch/alpha/kernel/srm_env.c provide several interfaces to > userspace, like

Re: [PATCH] fs/seq_file.c: Fix a UAF vulnerability in seq_release()

2019-07-10 Thread Matthew Wilcox
On Wed, Jul 10, 2019 at 06:26:29PM +0800, bsauce wrote: > In seq_release(), 'm->buf' points to a chunk. It is freed but not cleared to > null right away. It can be reused by seq_read() or srm_env_proc_write(). Well, no. The ->release method is called when there are no more file descriptors

Re: [PATCH] fs/seq_file.c: Fix a UAF vulnerability in seq_release()

2019-07-10 Thread Eric Dumazet
On 7/10/19 12:26 PM, bsauce wrote: > In seq_release(), 'm->buf' points to a chunk. It is freed but not cleared to > null right away. It can be reused by seq_read() or srm_env_proc_write(). > For example, /arch/alpha/kernel/srm_env.c provide several interfaces to > userspace, like

[PATCH] fs/seq_file.c: Fix a UAF vulnerability in seq_release()

2019-07-10 Thread bsauce
In seq_release(), 'm->buf' points to a chunk. It is freed but not cleared to null right away. It can be reused by seq_read() or srm_env_proc_write(). For example, /arch/alpha/kernel/srm_env.c provide several interfaces to userspace, like 'single_release', 'seq_read' and 'srm_env_proc_write'.