Re: [PATCH] Fix use-after-free with buffers

[Lachlan McIlroy <lachlan@sgi.com>]

Christoph Hellwig wrote:
> On Wed, Aug 20, 2008 at 03:21:48PM +1000, Lachlan McIlroy wrote:
>> 	XB_TRACE(bp, "rele", bp->b_relse);
>>
>> +	ASSERT(atomic_read(&bp->b_hold) > 0);
>> +
>> 	if (unlikely(!hash)) {
>> 		ASSERT(!bp->b_relse);
>> 		if (atomic_dec_and_test(&bp->b_hold))
>> @@ -838,7 +840,6 @@ xfs_buf_rele(
>> 		return;
>> 	}
>>
>> -	ASSERT(atomic_read(&bp->b_hold) > 0);
> 
> Makes sense, but how is this related to the other bits of the
> patch?  All but log and iozero buffers should always be hashed.
Okay, not specifically related.  I'll split it out of this change.

> 
>> @@ -732,6 +732,7 @@ xfs_buf_item_init(
>> 	bip->bli_item.li_ops = &xfs_buf_item_ops;
>> 	bip->bli_item.li_mountp = mp;
>> 	bip->bli_buf = bp;
>> +	xfs_buf_hold(bp);
> 
> These refcount changes look good to me.
> 
>> +void
>> +xfs_buf_item_free(
>> +	xfs_buf_log_item_t	*bip)
>> +{
>> +#ifdef XFS_TRANS_DEBUG
>> +	kmem_free(bip->bli_orig);
>> +	bip->bli_orig = NULL;
>> +	kmem_free(bip->bli_logged);
>> +	bip->bli_logged = NULL;
>> +#endif /* XFS_TRANS_DEBUG */
>> +
>> +#ifdef XFS_BLI_TRACE
>> +	ktrace_free(bip->bli_trace);
>> +#endif
>> +	kmem_zone_free(xfs_buf_item_zone, bip);
>> +}
> 
> Faktoring this out makes sense, although you might want to remove the
> zeroing of bip->bli_orig and bip->bli_logged while you're at it, so that
> slab poisoning can do it's work.
Okay, thanks, I'll post a V2.