lkml.org 
[lkml]   [2022]   [Oct]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: [PATCH RFC] block: fix use after free for bd_holder_dir/slave_dir
From
Date
Hi,

在 2022/10/17 19:36, Christoph Hellwig 写道:
> On Mon, Oct 17, 2022 at 05:24:20PM +0800, Yu Kuai wrote:
>> I agree that this patch do make sense, however, it seems to me this
>> patch should fix the problem that kobject is leaked, not uaf... And I
>> verified that the problem can still be reporduced with this patch.
>
> Can you share your reproducer?
> .
>

Of course, I add some delay in kernel to make sure the problem is
reproduced 100%:

diff --git a/block/holder.c b/block/holder.c
index 5283bc804cc1..be8f4b4245f3 100644
--- a/block/holder.c
+++ b/block/holder.c
@@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
#include <linux/blkdev.h>
#include <linux/slab.h>
+#include <linux/delay.h>

struct bd_holder_disk {
struct list_head list;
@@ -33,6 +34,8 @@ static int __link_disk_holder(struct block_device
*bdev, struct gendisk *disk)
{
int ret;

+ printk("%s: delay 5s\n", __func__);
+ msleep(5000);
ret = add_symlink(disk->slave_dir, bdev_kobj(bdev));
if (ret)
return ret;
test cmd is very simple:

dmsetup create test1 --table "0 100000 linear /dev/sda 0" &
sleep 1
echo 1 > /sys/block/sda/device/delete
\
 
 \ /
  Last update: 2022-10-17 15:18    [W:0.051 / U:0.956 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site