From: Dan Carpenter <dan.carpenter@oracle.com>
To: Jan Kara <jack@suse.cz>
Cc: Jason Yan <yanaijie@huawei.com>,
Markus Elfring <Markus.Elfring@web.de>,
linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org,
hulkci@huawei.com, kernel-janitors@vger.kernel.org,
linux-kernel@vger.kernel.org, Al Viro <viro@zeniv.linux.org.uk>,
Christoph Hellwig <hch@lst.de>, Jens Axboe <axboe@kernel.dk>,
Ming Lei <ming.lei@redhat.com>
Subject: Re: [PATCH v2] block: Fix use-after-free in blkdev_get()
Date: Fri, 05 Jun 2020 18:08:45 +0000 [thread overview]
Message-ID: <20200605180845.GU30374@kadam> (raw)
In-Reply-To: <20200605144236.GB13248@quack2.suse.cz>
On Fri, Jun 05, 2020 at 04:42:36PM +0200, Jan Kara wrote:
> On Fri 05-06-20 12:43:54, Dan Carpenter wrote:
> > I wonder if maybe the best fix is to re-add the "if (!res) " check back
> > to blkdev_get().
>
> Well, it won't be that simple since we need to call bd_abort_claiming()
> under bdev->bd_mutex. And the fact that __blkdev_get() frees the reference
> you pass to it is somewhat subtle and surprising so I think we are better
> off getting rid of that.
Fair enough.
Jason Yan sent a v3 of this patch that frees "whole". I've looked it
over pretty close and I think it's probably correct.
(not that my opinion should count for much because I don't know this
code very well at all).
regards,
dan carpenter
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Jan Kara <jack@suse.cz>
Cc: Jason Yan <yanaijie@huawei.com>,
Markus Elfring <Markus.Elfring@web.de>,
linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org,
hulkci@huawei.com, kernel-janitors@vger.kernel.org,
linux-kernel@vger.kernel.org, Al Viro <viro@zeniv.linux.org.uk>,
Christoph Hellwig <hch@lst.de>, Jens Axboe <axboe@kernel.dk>,
Ming Lei <ming.lei@redhat.com>
Subject: Re: [PATCH v2] block: Fix use-after-free in blkdev_get()
Date: Fri, 5 Jun 2020 21:08:45 +0300 [thread overview]
Message-ID: <20200605180845.GU30374@kadam> (raw)
In-Reply-To: <20200605144236.GB13248@quack2.suse.cz>
On Fri, Jun 05, 2020 at 04:42:36PM +0200, Jan Kara wrote:
> On Fri 05-06-20 12:43:54, Dan Carpenter wrote:
> > I wonder if maybe the best fix is to re-add the "if (!res) " check back
> > to blkdev_get().
>
> Well, it won't be that simple since we need to call bd_abort_claiming()
> under bdev->bd_mutex. And the fact that __blkdev_get() frees the reference
> you pass to it is somewhat subtle and surprising so I think we are better
> off getting rid of that.
Fair enough.
Jason Yan sent a v3 of this patch that frees "whole". I've looked it
over pretty close and I think it's probably correct.
(not that my opinion should count for much because I don't know this
code very well at all).
regards,
dan carpenter
next prev parent reply other threads:[~2020-06-05 18:08 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-05 8:30 [PATCH v2] block: Fix use-after-free in blkdev_get() Markus Elfring
2020-06-05 8:30 ` Markus Elfring
2020-06-05 9:05 ` Jason Yan
2020-06-05 9:05 ` Jason Yan
2020-06-05 9:43 ` Dan Carpenter
2020-06-05 9:43 ` Dan Carpenter
2020-06-05 10:56 ` Markus Elfring
2020-06-05 10:56 ` Markus Elfring
2020-06-05 11:10 ` Dan Carpenter
2020-06-05 11:10 ` Dan Carpenter
2020-06-05 11:40 ` Markus Elfring
2020-06-05 11:40 ` Markus Elfring
2020-06-05 11:42 ` Matthew Wilcox
2020-06-05 11:42 ` Matthew Wilcox
2020-06-05 12:47 ` Markus Elfring
2020-06-05 12:47 ` Markus Elfring
2020-06-05 12:52 ` Matthew Wilcox
2020-06-05 12:52 ` Matthew Wilcox
2020-06-05 13:12 ` Markus Elfring
2020-06-05 13:12 ` Markus Elfring
2020-06-05 15:15 ` Matthew Wilcox
2020-06-05 15:15 ` Matthew Wilcox
2020-06-05 15:25 ` Markus Elfring
2020-06-05 15:25 ` Markus Elfring
2020-06-05 11:10 ` [PATCH v2] " Matthew Wilcox
2020-06-05 11:10 ` Matthew Wilcox
2020-06-05 11:48 ` Markus Elfring
2020-06-05 11:48 ` Markus Elfring
2020-06-05 11:51 ` Matthew Wilcox
2020-06-05 11:51 ` Matthew Wilcox
2020-06-05 13:01 ` Markus Elfring
2020-06-05 13:01 ` Markus Elfring
2020-06-05 13:04 ` Jens Axboe
2020-06-05 13:04 ` Jens Axboe
2020-06-05 13:23 ` Markus Elfring
2020-06-05 13:23 ` Markus Elfring
2020-06-05 13:01 ` Markus Elfring
2020-06-05 13:01 ` Markus Elfring
2020-06-05 11:10 ` [PATCH v2] " Sedat Dilek
2020-06-05 11:10 ` Sedat Dilek
2020-06-05 14:42 ` Jan Kara
2020-06-05 14:42 ` Jan Kara
2020-06-05 18:08 ` Dan Carpenter [this message]
2020-06-05 18:08 ` Dan Carpenter
-- strict thread matches above, loose matches on Subject: below --
2020-06-05 6:43 Jason Yan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200605180845.GU30374@kadam \
--to=dan.carpenter@oracle.com \
--cc=Markus.Elfring@web.de \
--cc=axboe@kernel.dk \
--cc=hch@lst.de \
--cc=hulkci@huawei.com \
--cc=jack@suse.cz \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-block@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ming.lei@redhat.com \
--cc=viro@zeniv.linux.org.uk \
--cc=yanaijie@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.