On 3/13/21 1:02 AM, yangerkun wrote: > > > 在 2021/3/9 19:23, yangerkun 写道: >> >> >> 在 2021/3/8 22:22, Pavel Begunkov 写道: >>> On 08/03/2021 14:16, Pavel Begunkov wrote: >>>> From: "Matthew Wilcox (Oracle)" <willy@xxxxxxxxxxxxx> >>>> >>>> You can't call idr_remove() from within a idr_for_each() callback, >>>> but you can call xa_erase() from an xa_for_each() loop, so switch the >>>> entire personality_idr from the IDR to the XArray. This manifests as a >>>> use-after-free as idr_for_each() attempts to walk the rest of the node >>>> after removing the last entry from it. >>> >>> yangerkun, can you test it and similarly take care of buffer idr? >> >> Will try it latter :) > > Sorry for the latter reply. The patch pass the testcase. > > Besides, should we apply this patch first to deal with the same UAF for > io_buffer_idr before convert to XArray? > > https://lore.kernel.org/io-uring/20210308065903.2228332-2-yangerkun@xxxxxxxxxx/T/#u Agree, and then defer an xarray conversion to 5.13. I'll take a look at your patch and get it applied. -- Jens Axboe
