Re: KASAN: use-after-free Read in path_lookupat

From: Al Viro
Date: Mon Mar 25 2019 - 20:21:17 EST


On Mon, Mar 25, 2019 at 04:44:40PM -0700, Alexei Starovoitov wrote:
> On Mon, Mar 25, 2019 at 11:37:32PM +0000, Al Viro wrote:
> >
> > For debugfs it's clearly "use default ->evict_inode(), have explicit
> > ->destroy_inode() using free_inode_nonrcu()" - there we have nothing
> > else done in ->evict_inode() and kfree is obviously safe in softirq.
> > I'll post that (or push to vfs.git#fixes), along with minimal fixes
> > for other 3. If bpf_any_put() is softirq-safe, we'll have the full
> > set for -stable and the rest could be done on top of that.
>
> Yes. bpf_any_put() is safe to be called from softirq.

In that case,

Acked-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>

on Daniel's patch.