Re: [PATCH] bdi: fix use-after-free for bdi device

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

On Fri, Feb 14, 2020 at 10:50:01AM +0800, Yufen Yu wrote:
> > So, unregistering can leave ->dev along and re-registering can test
> > whether it's NULL and if not put the existing one and put a new one
> > there. Wouldn't that work?
> 
> Do you mean set bdi->dev as 'NULL' in call_rcu() callback function
> (i.e. bdi_release_device()) and test 'bdi->dev' in bdi_register_va()?
> 
> I think that may do not work.
> We cannot make sure the order of rcu callback function and re-registering.
> Then bdi_release_device() may put the new allocated device by re-registering.

No, I meant not freeing bdi->dev on deregistration and only doing so
when it actually needs to - on re-registration or release. So, sth
like the following.

* Unregister: Unregister bdi->dev but don't free it. Leave the pointer
  alone.

* Re-register: If bdi->dev is not null, initiate RCU-free and update
  bdi->dev to the new dev.

* Release: If bdi->dev is not NULL, initiate RCU-free of it.

Thanks.

-- 
tejun



[Index of Archives]     [Linux RAID]     [Linux SCSI]     [Linux ATA RAID]     [IDE]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Device Mapper]

  Powered by Linux