From: David Disseldorp <ddiss@suse.de>
To: Alex Elder <elder@linaro.org>, Ilya Dryomov <idryomov@gmail.com>
Cc: ceph-devel@vger.kernel.org
Subject: Re: [PATCH 8/8] rbd: img_data requests don't own their page array
Date: Mon, 26 Sep 2016 17:33:22 +0200 [thread overview]
Message-ID: <20160926173322.50fa05f8@echidna.suse.de> (raw)
In-Reply-To: <3fe273f8-7f12-26d4-885a-972e63c0b48e@linaro.org>
On Sun, 25 Sep 2016 12:06:34 -0500, Alex Elder wrote:
> On 09/19/2016 12:03 PM, Ilya Dryomov wrote:
> > Move the check into rbd_obj_request_destroy(), to avoid use-after-free
> > on errors in rbd_img_request_fill().
> >
> > Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
>
> Is this because an error occurring in rbd_img_request_fill()
> causes rbd_img_obj_request_del() to be called, which leads to
> rbd_obj_request_destroy(), which (by this time) has not yet
> had its obj_request->pages pointer set to NULL because the
> object request is still outstanding? (Your explanation was
> a little brief...)
I agree, the commit message could be improved...
I think the use after free is in the rbd_img_obj_parent_read_full()
call path - if rbd_img_request_fill() fails after adding an obj_request
to the img_request->obj_requests list, then the corresponding page(s)
will be freed in the rbd_img_request_fill() out_unwind error path *and*
the rbd_img_obj_parent_read_full() error path.
> The change in rbd_obj_request_destroy() looks good for that
> case.
>
> The code deleted in rbd_img_obj_end_request() could still stay,
> however. Almost everywhere, pointers are reassigned to NULL
> when it's known the thing referred to is no longer needed.
> It's useful in post-mortem understanding of what's occurred.
Agreed.
> I guess it's fine with me either way.
>
> Reviewed-by: Alex Elder <elder@linaro.org>
Looks fine to me too.
Reviewed-by: David Disseldorp <ddiss@suse.de>
next prev parent reply other threads:[~2016-09-26 15:33 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-19 17:03 [PATCH 0/8] rbd: layering (mostly) error path fixes Ilya Dryomov
2016-09-19 17:03 ` [PATCH 1/8] rbd: change rbd_obj_request_submit() signature Ilya Dryomov
2016-09-23 15:38 ` Alex Elder
2016-09-26 12:38 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 2/8] rbd: clean up asserts in rbd_img_obj_request_submit() helpers Ilya Dryomov
2016-09-23 15:57 ` Alex Elder
2016-09-23 16:07 ` Ilya Dryomov
2016-09-23 16:41 ` Alex Elder
2016-09-26 12:43 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 3/8] rbd: mark the original request as done if stat request fails Ilya Dryomov
2016-09-23 21:39 ` Alex Elder
2016-09-26 12:28 ` Ilya Dryomov
2016-09-19 17:03 ` [PATCH 4/8] rbd: move bumping img_request refcount into rbd_obj_request_submit() Ilya Dryomov
2016-09-25 15:56 ` Alex Elder
2016-09-26 14:38 ` Ilya Dryomov
2016-09-28 0:22 ` Alex Elder
2016-09-29 15:15 ` Ilya Dryomov
2016-09-19 17:03 ` [PATCH 5/8] rbd: don't crash or leak on errors in rbd_img_obj_parent_read_full_callback() Ilya Dryomov
2016-09-25 16:02 ` Alex Elder
2016-09-26 12:58 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 6/8] rbd: rework rbd_img_obj_exists_submit() error paths Ilya Dryomov
2016-09-25 16:30 ` Alex Elder
2016-09-26 12:05 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 7/8] rbd: don't call rbd_osd_req_format_read() for !img_data requests Ilya Dryomov
2016-09-25 16:44 ` Alex Elder
2016-09-26 16:37 ` Ilya Dryomov
2016-09-27 17:11 ` Alex Elder
2016-09-26 12:05 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 8/8] rbd: img_data requests don't own their page array Ilya Dryomov
2016-09-25 17:06 ` Alex Elder
2016-09-26 15:33 ` David Disseldorp [this message]
2016-09-26 17:25 ` Ilya Dryomov
2016-09-19 17:06 ` [PATCH 0/8] rbd: layering (mostly) error path fixes Alex Elder
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160926173322.50fa05f8@echidna.suse.de \
--to=ddiss@suse.de \
--cc=ceph-devel@vger.kernel.org \
--cc=elder@linaro.org \
--cc=idryomov@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox