On 1/25/21 10:21 AM, Josef Bacik wrote: > When setting up a device, we can krealloc the config->socks array to add > new sockets to the configuration. However if we happen to get a IO > request in at this point even though we aren't setup we could hit a UAF, > as we deref config->socks without any locking, assuming that the > configuration was setup already and that ->socks is safe to access it as > we have a reference on the configuration. > > But there's nothing really preventing IO from occurring at this point of > the device setup, we don't want to incur the overhead of a lock to > access ->socks when it will never change while the device is running. > To fix this UAF scenario simply freeze the queue if we are adding > sockets. This will protect us from this particular case without adding > any additional overhead for the normal running case. Applied, thanks. -- Jens Axboe
