Messages in this thread Patch in this message | | | From | Lv Yunlong <> | Subject | [PATCH] orangefs: Fix a use after free in purge_waiting_ops | Date | Tue, 27 Apr 2021 20:12:36 -0700 |
| |
In purge_waiting_ops, op is freed in set_op_state_purged() when op->upcal.type is a cancel type via op_release().But later the freed op is dereferenced in gossip_debug() via get_opname_string(op) and op->op_state.
My patch adds variables 'opname' and 'op_state' to avoid the uaf. But i see that op->op_state could be changed in a lock environment and i think move all the check condition outside set_op_state_purged() could be redundant.
Could you give some advice on how to handle the op->op_state?
Fixes: 9d9e7ba9ee8f3 ("Orangefs: improve gossip statements") Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> --- fs/orangefs/waitqueue.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/orangefs/waitqueue.c b/fs/orangefs/waitqueue.c index beafc33d57be..e00c74051936 100644 --- a/fs/orangefs/waitqueue.c +++ b/fs/orangefs/waitqueue.c @@ -34,6 +34,8 @@ static void orangefs_clean_up_interrupted_operation(struct orangefs_kernel_op_s void purge_waiting_ops(void) { struct orangefs_kernel_op_s *op, *tmp; + char *opname; + int op_state; spin_lock(&orangefs_request_list_lock); list_for_each_entry_safe(op, tmp, &orangefs_request_list, list) { @@ -41,12 +43,14 @@ void purge_waiting_ops(void) "pvfs2-client-core: purging op tag %llu %s\n", llu(op->tag), get_opname_string(op)); + opname = get_opname_string(op); + op_state = op->op_state; set_op_state_purged(op); gossip_debug(GOSSIP_DEV_DEBUG, "%s: op:%s: op_state:%d: process:%s:\n", __func__, - get_opname_string(op), - op->op_state, + opname, + op_state, current->comm); } spin_unlock(&orangefs_request_list_lock); -- 2.25.1
| |