Re: [PATCH v3] block: fix use-after-free on gendisk

[Jan Kara <jack@suse.cz>]

On Mon 15-04-19 08:56:35, Bart Van Assche wrote:
> On Tue, 2019-04-02 at 20:06 +0800, Yufen Yu wrote:
> > diff --git a/block/genhd.c b/block/genhd.c
> > index 961b2bc4634f..a4ef0068dbb2 100644
> > --- a/block/genhd.c
> > +++ b/block/genhd.c
> > @@ -529,6 +529,18 @@ void blk_free_devt(dev_t devt)
> >         }
> >  }
> >  
> > +/**
> > + *     We invalidate devt by assigning NULL pointer for devt in idr.
> > + */
> > +void blk_invalidate_devt(dev_t devt)
> > +{
> > +       if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
> > +               spin_lock_bh(&ext_devt_lock);
> > +               idr_replace(&ext_devt_idr, NULL, blk_mangle_minor(MINOR(devt)));
> > +               spin_unlock_bh(&ext_devt_lock);
> > +       }
> > +}
> 
> Did you perhaps copy the above code from blk_free_devt()? If so, please
> modify blk_free_devt() such that it calls blk_invalidate_devt() instead
> of introducing a copy of most of blk_free_devt().

I guess you've misread the patch. blk_free_devt() does idr_remove(). Here
we do idr_replace(). Subtle difference but an important one!

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR