Re: [PATCH] bdi: fix use-after-free for bdi device

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

On 2020/2/13 5:33, Tejun Heo wrote:

So, I don't see why bdi->dev should be freed before bdi itself does.
Would something like the following work?

bdi_unregister()
{
         ...
         if (bdi->dev) {
                 ...
                 device_get(bdi->dev);   // to be put on release
                 device_unregister(bdi->dev);
         }
         ...
}

release_bdi()
{
         ...
         if (bdi->dev) {
                 // warn if dev is still registered
                 device_put(bdi->dev);
         }
         ...
}

For each time of register, bdi_register() will try to create a new 'dev'.

bdi_register
    bdi_register_va
        if (bdi->dev) // if bdi->dev is not NULL, return directly
            return 0;
        dev = device_create_vargs()...

So, I think freeing bdi->dev until bdi itself does may be a problem
for drivers that supported re-registration bdi, such as:

commit b6f8fec4448aa52a8c36a392aa1ca2ea99acd460
Author: Jan Kara <jack@xxxxxxx>
Date:   Wed Mar 8 17:48:31 2017 +0100

    block: Allow bdi re-registration

    SCSI can call device_add_disk() several times for one request queue when
    a device in unbound and bound, creating new gendisk each time. This will
    lead to bdi being repeatedly registered and unregistered.







[Index of Archives]     [Linux RAID]     [Linux SCSI]     [Linux ATA RAID]     [IDE]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Device Mapper]

  Powered by Linux