On Sat, Mar 11, 2023 at 1:32 AM Yu Kuai <yukuai1@xxxxxxxxxxxxxxx> wrote: > > From: Yu Kuai <yukuai3@xxxxxxxxxx> > > Our test reports a uaf for 'mddev->sync_thread': > > T1 T2 > md_start_sync > md_register_thread > raid1d > md_check_recovery > md_reap_sync_thread > md_unregister_thread > kfree > > md_wakeup_thread > wake_up > ->sync_thread was freed > > Currently, a global spinlock 'pers_lock' is borrowed to protect > 'mddev->thread', this problem can be fixed likewise, however, there might > be similar problem for other md_thread, and I really don't like the idea to > borrow a global lock. > > This patchset do some refactor, and then use a disk level spinlock to > protect md_thread in relevant apis. > > Yu Kuai (5): > md: pass a md_thread pointer to md_register_thread() > md: refactor md_wakeup_thread() > md: use md_thread api to wake up sync_thread > md: pass a mddev to md_unregister_thread() > md: protect md_thread with a new disk level spin lock Applied to md-next. Thanks, Song
