Re: [patch 3/5] fs: fix bdi writeback use after free 1

Jens Axboe
2009-09-15T19:32:04Z

On Wed, Sep 16 2009, npiggin@suse.de wrote:
> By the time bdi_work_on_stack gets evaluated again in bdi_work_free, it
> cna already have been deallocated and used for something else in the
> !on stack case, giving a false positive in this test and causing corruption.

You are right, that is also buggy... Applied.

>
> Signed-off-by: Nick Piggin <npiggin@suse.de>
> ---
> fs/fs-writeback.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> Index: linux-2.6/fs/fs-writeback.c
> ===================================================================
> --- linux-2.6.orig/fs/fs-writeback.c
> +++ linux-2.6/fs/fs-writeback.c
> @@ -114,6 +114,7 @@ static void bdi_work_free(struct rcu_hea
> static void wb_work_complete(struct bdi_work *work)
> {
> const enum writeback_sync_modes sync_mode = work->sync_mode;
> + int onstack = bdi_work_on_stack(work);
>
> /*
> * For allocated work, we can clear the done/seen bit right here.
> @@ -121,9 +122,9 @@ static void wb_work_complete(struct bdi_
> * to after the RCU grace period, since the stack could be invalidated
> * as soon as bdi_work_clear() has done the wakeup.
> */
> - if (!bdi_work_on_stack(work))
> + if (!onstack)
> bdi_work_clear(work);
> - if (sync_mode == WB_SYNC_NONE || bdi_work_on_stack(work))
> + if (sync_mode == WB_SYNC_NONE || onstack)
> call_rcu(&work->rcu_head, bdi_work_free);
> }
>
>
>

--
Jens Axboe