Re: [PATCH v3] block: fix use-after-free on gendisk

[Bart Van Assche <bvanassche@acm.org>]

On Tue, 2019-04-02 at 20:06 +0800, Yufen Yu wrote:
> diff --git a/block/genhd.c b/block/genhd.c
> index 961b2bc4634f..a4ef0068dbb2 100644
> --- a/block/genhd.c
> +++ b/block/genhd.c
> @@ -529,6 +529,18 @@ void blk_free_devt(dev_t devt)
>         }
>  }
>  
> +/**
> + *     We invalidate devt by assigning NULL pointer for devt in idr.
> + */
> +void blk_invalidate_devt(dev_t devt)
> +{
> +       if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
> +               spin_lock_bh(&ext_devt_lock);
> +               idr_replace(&ext_devt_idr, NULL, blk_mangle_minor(MINOR(devt)));
> +               spin_unlock_bh(&ext_devt_lock);
> +       }
> +}

Did you perhaps copy the above code from blk_free_devt()? If so, please modify
blk_free_devt() such that it calls blk_invalidate_devt() instead of introducing a
copy of most of blk_free_devt().

Thanks,

Bart.