Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <CAEf4BzY-p13huoqo6N7LJRVVj8rcjPeP3Cp=KDX4N2x9BkC9Zw@mail.gmail.com>
 <20220517180420.87954-1-tadeusz.struk@linaro.org> <7949d722-86e8-8122-e607-4b09944b76ae@linaro.org>
 <CAEf4BzaD1Z6uOZwbquPYWB0_Z0+CkEKiXQ6zS2imiSHpTgX3pg@mail.gmail.com> <41265f4d-45b4-a3a6-e0c0-5460d2a06377@linaro.org>
In-Reply-To: <41265f4d-45b4-a3a6-e0c0-5460d2a06377@linaro.org>
From:   Andrii Nakryiko <andrii.nakryiko@gmail.com>
Date:   Thu, 2 Jun 2022 09:11:19 -0700
Message-ID: <CAEf4Bza-fp-9j+dzwdJQagxVNseNofxY2aJV0E6eHw+eQyyeaQ@mail.gmail.com>
Subject: Re: [PATCH v4] bpf: Fix KASAN use-after-free Read in compute_effective_progs
To:     Tadeusz Struk <tadeusz.struk@linaro.org>
Cc:     Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        Martin KaFai Lau <kafai@fb.com>,
        Song Liu <songliubraving@fb.com>, Yonghong Song <yhs@fb.com>,
        John Fastabend <john.fastabend@gmail.com>,
        KP Singh <kpsingh@kernel.org>,
        Networking <netdev@vger.kernel.org>, bpf <bpf@vger.kernel.org>,
        linux- stable <stable@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        syzbot+f264bffdfbd5614f3bb2@syzkaller.appspotmail.com
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Thu, Jun 2, 2022 at 7:37 AM Tadeusz Struk <tadeusz.struk@linaro.org> wrote:
>
> Hi Andrii,
> On 5/23/22 15:47, Andrii Nakryiko wrote:
> >> Hi Andrii,
> >> Do you have any more feedback? Does it look better to you now?
> > Hi, this is on my TODO list, but I need a bit more focused time to
> > think all this through and I haven't managed to get it in last week.
> > I'm worried about the percpu_ref_is_zero(&desc->bpf.refcnt) portion
> > and whether it can cause some skew in the calculated array index, I
> > need to look at this a bit more in depth. Sorry for the delay.
>
> Did you get a chance to look at this yet?
>

Hm.. I've applied it two days ago, but for some reason there was no
notification from the bot. It's now c89c79fda9b6 ("bpf: Fix KASAN
use-after-free Read in compute_effective_progs").

> --
> Thanks,
> Tadeusz