From: David Disseldorp <ddiss@suse.de>
To: Alex Elder <elder@linaro.org>, Ilya Dryomov <idryomov@gmail.com>
Cc: ceph-devel@vger.kernel.org
Subject: Re: [PATCH 8/8] rbd: img_data requests don't own their page array
Date: Mon, 26 Sep 2016 17:33:22 +0200 [thread overview]
Message-ID: <20160926173322.50fa05f8@echidna.suse.de> (raw)
In-Reply-To: <3fe273f8-7f12-26d4-885a-972e63c0b48e@linaro.org>
On Sun, 25 Sep 2016 12:06:34 -0500, Alex Elder wrote:
> On 09/19/2016 12:03 PM, Ilya Dryomov wrote:
> > Move the check into rbd_obj_request_destroy(), to avoid use-after-free
> > on errors in rbd_img_request_fill().
> >
> > Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
>
> Is this because an error occurring in rbd_img_request_fill()
> causes rbd_img_obj_request_del() to be called, which leads to
> rbd_obj_request_destroy(), which (by this time) has not yet
> had its obj_request->pages pointer set to NULL because the
> object request is still outstanding? (Your explanation was
> a little brief...)
I agree, the commit message could be improved...
I think the use after free is in the rbd_img_obj_parent_read_full()
call path - if rbd_img_request_fill() fails after adding an obj_request
to the img_request->obj_requests list, then the corresponding page(s)
will be freed in the rbd_img_request_fill() out_unwind error path *and*
the rbd_img_obj_parent_read_full() error path.
> The change in rbd_obj_request_destroy() looks good for that
> case.
>
> The code deleted in rbd_img_obj_end_request() could still stay,
> however. Almost everywhere, pointers are reassigned to NULL
> when it's known the thing referred to is no longer needed.
> It's useful in post-mortem understanding of what's occurred.
Agreed.
> I guess it's fine with me either way.
>
> Reviewed-by: Alex Elder <elder@linaro.org>
Looks fine to me too.
Reviewed-by: David Disseldorp <ddiss@suse.de>
next prev parent reply other threads:[~2016-09-26 15:33 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-19 17:03 [PATCH 0/8] rbd: layering (mostly) error path fixes Ilya Dryomov
2016-09-19 17:03 ` [PATCH 1/8] rbd: change rbd_obj_request_submit() signature Ilya Dryomov
2016-09-23 15:38 ` Alex Elder
2016-09-26 12:38 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 2/8] rbd: clean up asserts in rbd_img_obj_request_submit() helpers Ilya Dryomov
2016-09-23 15:57 ` Alex Elder
2016-09-23 16:07 ` Ilya Dryomov
2016-09-23 16:41 ` Alex Elder
2016-09-26 12:43 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 3/8] rbd: mark the original request as done if stat request fails Ilya Dryomov
2016-09-23 21:39 ` Alex Elder
2016-09-26 12:28 ` Ilya Dryomov
2016-09-19 17:03 ` [PATCH 4/8] rbd: move bumping img_request refcount into rbd_obj_request_submit() Ilya Dryomov
2016-09-25 15:56 ` Alex Elder
2016-09-26 14:38 ` Ilya Dryomov
2016-09-28 0:22 ` Alex Elder
2016-09-29 15:15 ` Ilya Dryomov
2016-09-19 17:03 ` [PATCH 5/8] rbd: don't crash or leak on errors in rbd_img_obj_parent_read_full_callback() Ilya Dryomov
2016-09-25 16:02 ` Alex Elder
2016-09-26 12:58 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 6/8] rbd: rework rbd_img_obj_exists_submit() error paths Ilya Dryomov
2016-09-25 16:30 ` Alex Elder
2016-09-26 12:05 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 7/8] rbd: don't call rbd_osd_req_format_read() for !img_data requests Ilya Dryomov
2016-09-25 16:44 ` Alex Elder
2016-09-26 16:37 ` Ilya Dryomov
2016-09-27 17:11 ` Alex Elder
2016-09-26 12:05 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 8/8] rbd: img_data requests don't own their page array Ilya Dryomov
2016-09-25 17:06 ` Alex Elder
2016-09-26 15:33 ` David Disseldorp [this message]
2016-09-26 17:25 ` Ilya Dryomov
2016-09-19 17:06 ` [PATCH 0/8] rbd: layering (mostly) error path fixes Alex Elder
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160926173322.50fa05f8@echidna.suse.de \
--to=ddiss@suse.de \
--cc=ceph-devel@vger.kernel.org \
--cc=elder@linaro.org \
--cc=idryomov@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.