On 3/13/21 8:34 AM, Jens Axboe wrote: > On 3/13/21 1:02 AM, yangerkun wrote: >> >> >> 在 2021/3/9 19:23, yangerkun 写道: >>> >>> >>> 在 2021/3/8 22:22, Pavel Begunkov 写道: >>>> On 08/03/2021 14:16, Pavel Begunkov wrote: >>>>> From: "Matthew Wilcox (Oracle)" <willy@xxxxxxxxxxxxx> >>>>> >>>>> You can't call idr_remove() from within a idr_for_each() callback, >>>>> but you can call xa_erase() from an xa_for_each() loop, so switch the >>>>> entire personality_idr from the IDR to the XArray. This manifests as a >>>>> use-after-free as idr_for_each() attempts to walk the rest of the node >>>>> after removing the last entry from it. >>>> >>>> yangerkun, can you test it and similarly take care of buffer idr? >>> >>> Will try it latter :) >> >> Sorry for the latter reply. The patch pass the testcase. >> >> Besides, should we apply this patch first to deal with the same UAF for >> io_buffer_idr before convert to XArray? >> >> https://lore.kernel.org/io-uring/20210308065903.2228332-2-yangerkun@xxxxxxxxxx/T/#u > > Agree, and then defer an xarray conversion to 5.13. I'll take a look at > your patch and get it applied. That one is very broken, it both fails removal cases and it's got leak issues too. I'm going to take a look at just doing xarray instead. -- Jens Axboe
