public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH 0/3] lib/percpu-refcount: fix use-after-free by late ->release
@ 2022-12-14  2:50 Ming Lei
  2022-12-14  2:50 ` [PATCH 1/3] lib/percpu-refcount: support to exit refcount automatically during releasing Ming Lei
                   ` (3 more replies)
  0 siblings, 4 replies; 11+ messages in thread
From: Ming Lei @ 2022-12-14  2:50 UTC (permalink / raw)
  To: Jens Axboe, Tejun Heo
  Cc: linux-block, linux-kernel, Zhong Jinghua, Yu Kuai, Dennis Zhou,
	Ming Lei

Hi,

The pattern of wait_event(percpu_ref_is_zero()) may cause
percpu_ref_exit() to be called before ->release() is done, so
user-after-free may be caused, fix the issue by draining ->release()
in percpu_ref_exit().


Ming Lei (3):
  lib/percpu-refcount: support to exit refcount automatically during
    releasing
  lib/percpu-refcount: apply PERCPU_REF_AUTO_EXIT
  lib/percpu-refcount: drain ->release() in perpcu_ref_exit()

 drivers/infiniband/ulp/rtrs/rtrs-srv.c |  4 +--
 include/linux/percpu-refcount.h        | 36 ++++++++++++++++++++++++--
 lib/percpu-refcount.c                  | 31 +++++++++++++++++++---
 mm/memcontrol.c                        |  5 ++--
 4 files changed, 66 insertions(+), 10 deletions(-)

-- 
2.38.1


^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2022-12-17  7:33 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-12-14  2:50 [PATCH 0/3] lib/percpu-refcount: fix use-after-free by late ->release Ming Lei
2022-12-14  2:50 ` [PATCH 1/3] lib/percpu-refcount: support to exit refcount automatically during releasing Ming Lei
2022-12-14  2:51 ` [PATCH 2/3] lib/percpu-refcount: apply PERCPU_REF_AUTO_EXIT Ming Lei
2022-12-14  2:51 ` [PATCH 3/3] lib/percpu-refcount: drain ->release() in perpcu_ref_exit() Ming Lei
2022-12-15 16:54   ` Tejun Heo
2022-12-16 23:06   ` kernel test robot
2022-12-17  0:37   ` kernel test robot
2022-12-17  7:32   ` kernel test robot
     [not found] ` <20221214081651.954-1-hdanton@sina.com>
2022-12-14 13:30   ` Ming Lei
2022-12-14 16:07     ` Dennis Zhou
2022-12-15  0:34       ` Ming Lei

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox