From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755862AbcAOAmK (ORCPT ); Thu, 14 Jan 2016 19:42:10 -0500 Received: from mail-pa0-f41.google.com ([209.85.220.41]:33732 "EHLO mail-pa0-f41.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751923AbcAOAmI (ORCPT ); Thu, 14 Jan 2016 19:42:08 -0500 Date: Fri, 15 Jan 2016 09:43:17 +0900 From: Sergey Senozhatsky To: Jerome Marchand Cc: Minchan Kim , Andrew Morton , Sergey Senozhatsky , Sergey Senozhatsky , linux-kernel@vger.kernel.org Subject: Re: [PATCH] zram: don't call idr_remove() from zram_remove() Message-ID: <20160115004317.GA1993@swordfish> References: <1452776627-21662-1-git-send-email-jmarchan@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1452776627-21662-1-git-send-email-jmarchan@redhat.com> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Cc Andrew On (01/14/16 14:03), Jerome Marchand wrote: > The use of idr_remove() is forbidden in the callback functions of > idr_for_each(). It is therefore unsafe to call idr_remove in > zram_remove(). > This patch moves the call to idr_remove() from zram_remove() to > hot_remove_store(). In the detroy_devices() path, idrs are removed by > idr_destroy(). > This solves an use-after-free detected by KASan. thanks, good catch! wow, I must be blind or stupid, or both. Acked-by: Sergey Senozhatsky a nano nitpick to add curly braces in the else clause. but, what is more important, may I please ask you to add -stable [4.2+] > Signed-off-by: Jerome Marchand + Cc: and to resend the patch? idr added in 4.2 https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/drivers/block/zram/zram_drv.c?id=refs/tags/v4.2 -ss > --- > drivers/block/zram/zram_drv.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c > index 47915d7..5e86e1d 100644 > --- a/drivers/block/zram/zram_drv.c > +++ b/drivers/block/zram/zram_drv.c > @@ -1325,7 +1325,6 @@ static int zram_remove(struct zram *zram) > > pr_info("Removed device: %s\n", zram->disk->disk_name); > > - idr_remove(&zram_index_idr, zram->disk->first_minor); > blk_cleanup_queue(zram->disk->queue); > del_gendisk(zram->disk); > put_disk(zram->disk); > @@ -1367,9 +1366,10 @@ static ssize_t hot_remove_store(struct class *class, > mutex_lock(&zram_index_mutex); > > zram = idr_find(&zram_index_idr, dev_id); > - if (zram) > + if (zram) { > ret = zram_remove(zram); > - else > + idr_remove(&zram_index_idr, dev_id); + } else { > ret = -ENODEV; + } > mutex_unlock(&zram_index_mutex); > -- > 2.5.0 >