Re: [PATCH v3] SUNRPC/cache: Fix unsafe traverse caused double-free in cache_purge

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




> On Apr 5, 2020, at 2:31 PM, Yihao Wu <wuyihao@xxxxxxxxxxxxxxxxx> wrote:
> 
>>> net/sunrpc/cache.c | 4 +++-
>>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>> 
>>> diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
>>> index af0ddd28b081..b445874e8e2f 100644
>>> --- a/net/sunrpc/cache.c
>>> +++ b/net/sunrpc/cache.c
>>> @@ -541,7 +541,9 @@ void cache_purge(struct cache_detail *detail)
>>> 	dprintk("RPC: %d entries in %s cache\n", detail->entries, detail->name);
>>> 	for (i = 0; i < detail->hash_size; i++) {
>>> 		head = &detail->hash_table[i];
>>> -		hlist_for_each_entry_safe(ch, tmp, head, cache_list) {
>> 
>> If review/testing shows you need to respin this patch, I note that "tmp" is
>> now unused and should be removed. I've pulled v3 into my testing branch and
>> made that minor change. Thanks!
>> 
>> 
>>> +		while (!hlist_empty(head)) {
>>> +			ch = hlist_entry(head->first, struct cache_head,
>>> +					 cache_list);
>>> 			sunrpc_begin_cache_remove_entry(ch, detail);
>>> 			spin_unlock(&detail->hash_lock);
>>> 			sunrpc_end_cache_remove_entry(ch, detail);
>>> -- 
>>> 2.20.1.2432.ga663e714
>> 
>> --
>> Chuck Lever
>> 
>> 
> 
> Thanks a lot, Chuck!
> 
> If it needs further changes by me, I'll fix the unused 'tmp' along with them.
> 
> BTW, if you and Neil think it's proper to add Signed-off-by Neil too later,
> please do, since the bug fix owes to Neil's idea :-)

Actually a "Suggested-by:" tag is appropriate for attribution. I'll add:

Suggested-by: NeilBrown <neilb@xxxxxxx>

to what I have in my tree.


--
Chuck Lever







[Index of Archives]     [Linux Filesystem Development]     [Linux USB Development]     [Linux Media Development]     [Video for Linux]     [Linux NILFS]     [Linux Audio Users]     [Yosemite Info]     [Linux SCSI]

  Powered by Linux