diff options
author | Ming Lei <ming.lei@redhat.com> | 2020-05-08 11:17:55 +0300 |
---|---|---|
committer | Jens Axboe <axboe@kernel.dk> | 2020-05-13 05:31:39 +0300 |
commit | b7d6c30333239f77f8e51423064a623acc7fd127 (patch) | |
tree | 0f40462c0e231e405291ed5a2c32e0f9d6795ada /block/partitions/amiga.c | |
parent | aa880ad690ab6d4c53934af85fb5a43e69ecb0f5 (diff) | |
download | linux-b7d6c30333239f77f8e51423064a623acc7fd127.tar.xz |
block: fix use-after-free on cached last_lookup partition
delete_partition() clears the cached last_lookup partition. However the
.last_lookup cache may be overwritten by one IO path after it is cleared
from delete_partition(). Then another IO path may use the cached deleting
partition after hd_struct_free() is called, then use-after-free is triggered
on the cached partition.
Fixes the issue by the following approach:
1) always get the partition's refcount via hd_struct_try_get() before
setting .last_lookup
2) move clearing .last_lookup from delete_partition() to hd_struct_free()
which is the release handle of the partition's percpu-refcount, so that no
IO path can cache deleteing partition via .last_lookup.
It is one candidate approach of Yufen's patch[1] which adds overhead
in fast path by indirect lookup which may introduce one extra cacheline
in IO path. Also this patch relies on percpu-refcount's protection, and
it is easier to understand and verify.
[1] https://lore.kernel.org/linux-block/20200109013551.GB9655@ming.t460p/T/#t
Reported-by: Yufen Yu <yuyufen@huawei.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Christoph Hellwig <hch@infradead.org>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Hou Tao <houtao1@huawei.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block/partitions/amiga.c')
0 files changed, 0 insertions, 0 deletions