Hi,
在 2022/11/01 18:49, Christoph Hellwig 写道:
On Mon, Oct 31, 2022 at 09:52:04AM +0800, Yu Kuai wrote:
INIT_LIST_HEAD(&holder->list);
- holder->bdev = bdev;
holder->refcnt = 1;
+ holder->holder_dir = kobject_get(bdev->bd_holder_dir);
I wonder is this safe here, if kobject reference is 0 here and
bd_holder_dir is about to be freed. Here in kobject_get, kref_get() will
warn about uaf, and kobject_get will return a address that is about to
be freed.
But how could the reference be 0 here? The driver that calls
bd_link_disk_holder must have the block device open and thus hold a
reference to it.
Like I said before, the caller of bd_link_disk_holder() get bdev by
blkdev_get_by_dev(), which do not grab reference of holder_dir, and
grab disk reference can only prevent disk_release() to be called, not
del_gendisk() while holder_dir reference is dropped in del_gendisk()
and can be decreased to 0.
If you agree with above explanation, I tried to fix this:
1) move kobject_put(bd_holder_dir) from del_gendisk to disk_release,
there seems to be a lot of other dependencies.
2) protect bd_holder_dir reference by open_mutex.
Thanks,
Kuai
.
