Messages in this thread Patch in this message | | | Subject | Re: [PATCH RFC] block: fix use after free for bd_holder_dir/slave_dir | From | Yu Kuai <> | Date | Mon, 17 Oct 2022 21:17:03 +0800 |
| |
Hi,
在 2022/10/17 19:36, Christoph Hellwig 写道: > On Mon, Oct 17, 2022 at 05:24:20PM +0800, Yu Kuai wrote: >> I agree that this patch do make sense, however, it seems to me this >> patch should fix the problem that kobject is leaked, not uaf... And I >> verified that the problem can still be reporduced with this patch. > > Can you share your reproducer? > . >
Of course, I add some delay in kernel to make sure the problem is reproduced 100%:
diff --git a/block/holder.c b/block/holder.c index 5283bc804cc1..be8f4b4245f3 100644 --- a/block/holder.c +++ b/block/holder.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only #include <linux/blkdev.h> #include <linux/slab.h> +#include <linux/delay.h>
struct bd_holder_disk { struct list_head list; @@ -33,6 +34,8 @@ static int __link_disk_holder(struct block_device *bdev, struct gendisk *disk) { int ret;
+ printk("%s: delay 5s\n", __func__); + msleep(5000); ret = add_symlink(disk->slave_dir, bdev_kobj(bdev)); if (ret) return ret; test cmd is very simple:
dmsetup create test1 --table "0 100000 linear /dev/sda 0" & sleep 1 echo 1 > /sys/block/sda/device/delete
| |