Re: v4.20-rc6: Sporadic use-after-free in bt_iter()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, 2018-12-20 at 15:50 -0700, Jens Axboe wrote:
+AD4 +-static void blk+AF8-fq+AF8-rcu+AF8-free(struct work+AF8-struct +ACo-work)
+AD4 +-+AHs
+AD4 +-	struct blk+AF8-flush+AF8-queue +ACo-fq +AD0 container+AF8-of(to+AF8-rcu+AF8-work(work),
+AD4 +-							struct blk+AF8-flush+AF8-queue,
+AD4 +-							rcu+AF8-work)+ADs
+AD4 +-
+AD4 +-	kfree(fq-+AD4-flush+AF8-rq)+ADs
+AD4 +-	kfree(fq)+ADs
+AD4 +-+AH0
+AD4 +-
+AD4  void blk+AF8-free+AF8-flush+AF8-queue(struct blk+AF8-flush+AF8-queue +ACo-fq)
+AD4  +AHs
+AD4  	/+ACo bio based request queue hasn't flush queue +ACo-/
+AD4  	if (+ACE-fq)
+AD4  		return+ADs
+AD4  
+AD4 -	kfree(fq-+AD4-flush+AF8-rq)+ADs
+AD4 -	kfree(fq)+ADs
+AD4 +-	INIT+AF8-RCU+AF8-WORK(+ACY-fq-+AD4-rcu+AF8-work, blk+AF8-fq+AF8-rcu+AF8-free)+ADs
+AD4 +-	queue+AF8-rcu+AF8-work(system+AF8-wq, +ACY-fq-+AD4-rcu+AF8-work)+ADs
+AD4  +AH0

Can INIT+AF8-RCU+AF8-WORK() +- queue+AF8-rcu+AF8-work() be changed into call+AF8-rcu()? The latter
namely uses a smaller data structure.

+AD4 diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
+AD4 index 2089c6c62f44..c39b58391ae8 100644
+AD4 --- a/block/blk-mq-tag.c
+AD4 +-+-+- b/block/blk-mq-tag.c
+AD4 +AEAAQA -228,13 +-228,15 +AEAAQA static bool bt+AF8-iter(struct sbitmap +ACo-bitmap, unsigned int bitnr, void +ACo-data)
+AD4  
+AD4  	if (+ACE-reserved)
+AD4  		bitnr +-+AD0 tags-+AD4-nr+AF8-reserved+AF8-tags+ADs
+AD4 -	rq +AD0 tags-+AD4-rqs+AFs-bitnr+AF0AOw
+AD4 +-	if (tags-+AD4-rqs+AFs-bitnr+AF0.queue +ACEAPQ hctx-+AD4-queue)
+AD4 +-		return true+ADs

Since blk+AF8-mq+AF8-tag+AF8-set+AF8-rq() is not serialized against this function I doubt that
the tags-+AD4-rqs+AFs-bitnr+AF0.queue +ACEAPQ hctx-+AD4-queue check helps. Can it be left out?

+AD4 +-struct rq+AF8-tag+AF8-entry +AHs
+AD4 +-       struct request+AF8-queue +ACo-queue+ADs
+AD4 +-       struct request +ACo-rq+ADs

If the new test can be left out from bt+AF8-iter(), can this new data structure be
left out too? In other words, keep the existing approach of only storing the
request pointer and not the queue pointer.

Thanks,

Bart.



[Index of Archives]     [Linux RAID]     [Linux SCSI]     [Linux ATA RAID]     [IDE]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Device Mapper]

  Powered by Linux