Re: KASAN: use-after-free Read in path_lookupat

[Daniel Borkmann]

On 03/25/2019 11:13 PM, Linus Torvalds wrote:
> On Mon, Mar 25, 2019 at 3:04 PM Daniel Borkmann <daniel@xxxxxxxxxxxxx> wrote:
>>
>> I'm fine either way, I think the rcu_destroy_inode would indeed simplify
>> it nicely. In any case fwiw, here's what I'd have ready for standby on bpf
>> side and tested as well. Decided to get rid of bpf_evict_inode() entirely
>> since the only callback we'd really need is on final inode destruction:
> 
> Yes, this looks correct to me.
> 
> I think this is worth doing regardless. Even if we then make the vfs
> layer add that rcu_destroy_inode(), that will fit very well with this
> patch, and getting rid of the special bpf_evict_inode() logic and just
> letting the normal vfs inode cleanup happen looks like the right
> thing.
> 
> So ack from me on your
> 
>> Subject: [PATCH bpf] bpf: fix use after free in bpf_evict_inode
> 
> patch regardless of what else we might end up doing in this area to
> clean things up.

Ok, thanks a lot. In that case, I just pushed this one to bpf tree, and
it will come your way the usual route via David.

Thanks,
Daniel