Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 04 Aug 2022 14:09:36 +0530
From:   Siddh Raman Pant <code@siddh.me>
To:     "Eric Biggers" <ebiggers@kernel.org>
Cc:     "David Howells" <dhowells@redhat.com>,
        "Christophe JAILLET" <christophe.jaillet@wanadoo.fr>,
        "Eric Dumazet" <edumazet@google.com>,
        "Fabio M. De Francesco" <fmdefrancesco@gmail.com>,
        "linux-security-modules" <linux-security-module@vger.kernel.org>,
        "linux-kernel" <linux-kernel@vger.kernel.org>,
        "linux-kernel-mentees" 
        <linux-kernel-mentees@lists.linuxfoundation.org>,
        "syzbot+c70d87ac1d001f29a058" 
        <syzbot+c70d87ac1d001f29a058@syzkaller.appspotmail.com>
Message-ID: <182680296de.8276ed8742454.8804921618540697946@siddh.me>
In-Reply-To: <Yuq7Q//SH/HjLsxH@gmail.com>
References: <20220728155121.12145-1-code@siddh.me>
 <YunKlJCDlmyn2hJ4@sol.localdomain>
 <18261d8a63a.33799d2a402802.7512018232560408914@siddh.me>
 <Yun1rC59USrgd0fu@sol.localdomain>
 <182621f8dca.1e0e6161130907.1470656861897824669@siddh.me>
 <YuoKi0GigXm/Hcb+@sol.localdomain>
 <18262dcb20e.4bf31faa421018.1228982721921458740@siddh.me> <Yuq7Q//SH/HjLsxH@gmail.com>
Subject: Re: [PATCH v3] kernel/watch_queue: Make pipe NULL while clearing
 watch_queue
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Importance: Medium
User-Agent: Zoho Mail
Precedence: bulk

On Wed, 03 Aug 2022 23:45:31 +0530  Eric Biggers  wrote:
> Well, you should try listening instead.  Because you are not listening.

Sorry for that, never meant to come across like that.

> Even if wqueue->pipe was set to NULL during free_pipe_info(), there would still
> have been a use-after-free, as the real bug was the lack of synchronization
> between post_one_notification() and free_pipe_info().  That is fixed now.

Okay, noted.

> To re-iterate, I encourage you to send a cleanup patch if you see an
> opportunity.  It looks like the state wqueue->defunct==true could be replaced
> with wqueue->pipe==NULL, which would be simpler, so how about doing that?  Just
> don't claim that it is "fixing" something, unless it is, as that makes things
> very confusing and difficult for everyone.

Okay, I will do that. That actually seems like a plausible thing to do, in
v2 convo, David Howells had also remarked similarly about `defunct` to a reply.

https://lore.kernel.org/linux-kernel/3565221.1658933355@warthog.procyon.org.uk/

> A reproducer can just be written as a normal program, in C or another language.
> The syzkaller reproducers are really hard to read as they are auto-generated, so
> don't read too much into them -- they're certainly not examples of good code.
> 
> - Eric

Okay, noted.

Thanks for your patience, I probably annoyed you.

Thanks,
Siddh