Hi,
在 2022/10/17 19:36, Christoph Hellwig 写道:
On Mon, Oct 17, 2022 at 05:24:20PM +0800, Yu Kuai wrote:
I agree that this patch do make sense, however, it seems to me this
patch should fix the problem that kobject is leaked, not uaf... And I
verified that the problem can still be reporduced with this patch.
Can you share your reproducer?
.
Of course, I add some delay in kernel to make sure the problem is
reproduced 100%:
diff --git a/block/holder.c b/block/holder.c
index 5283bc804cc1..be8f4b4245f3 100644
--- a/block/holder.c
+++ b/block/holder.c
@@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
#include <linux/blkdev.h>
#include <linux/slab.h>
+#include <linux/delay.h>
struct bd_holder_disk {
struct list_head list;
@@ -33,6 +34,8 @@ static int __link_disk_holder(struct block_device
*bdev, struct gendisk *disk)
{
int ret;
+ printk("%s: delay 5s\n", __func__);
+ msleep(5000);
ret = add_symlink(disk->slave_dir, bdev_kobj(bdev));
if (ret)
return ret;
test cmd is very simple:
dmsetup create test1 --table "0 100000 linear /dev/sda 0" &
sleep 1
echo 1 > /sys/block/sda/device/delete
