Files
linux/include/linux
Yufen Yu 6fcc44d1d7 block: fix use-after-free on gendisk
commit 2da78092dd "block: Fix dev_t minor allocation lifetime"
specifically moved blk_free_devt(dev->devt) call to part_release()
to avoid reallocating device number before the device is fully
shutdown.

However, it can cause use-after-free on gendisk in get_gendisk().
We use md device as example to show the race scenes:

Process1		Worker			Process2
md_free
						blkdev_open
del_gendisk
  add delete_partition_work_fn() to wq
  						__blkdev_get
						get_gendisk
put_disk
  disk_release
    kfree(disk)
    						find part from ext_devt_idr
						get_disk_and_module(disk)
    					  	cause use after free

    			delete_partition_work_fn
			put_device(part)
    		  	part_release
		    	remove part from ext_devt_idr

Before <devt, hd_struct pointer> is removed from ext_devt_idr by
delete_partition_work_fn(), we can find the devt and then access
gendisk by hd_struct pointer. But, if we access the gendisk after
it have been freed, it can cause in use-after-freeon gendisk in
get_gendisk().

We fix this by adding a new helper blk_invalidate_devt() in
delete_partition() and del_gendisk(). It replaces hd_struct
pointer in idr with value 'NULL', and deletes the entry from
idr in part_release() as we do now.

Thanks to Jan Kara for providing the solution and more clear comments
for the code.

Fixes: 2da78092dd ("block: Fix dev_t minor allocation lifetime")
Cc: Al Viro <viro@zeniv.linux.org.uk>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Keith Busch <keith.busch@intel.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Yufen Yu <yuyufen@huawei.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2019-04-22 09:48:12 -06:00
..
2018-11-14 10:56:33 -08:00
2019-02-15 16:47:55 +02:00
2018-10-16 11:13:50 +02:00
2018-11-12 10:33:49 +01:00
2019-03-29 12:24:41 -07:00
2019-02-28 09:16:12 +01:00
2019-02-08 22:39:01 -08:00
2019-04-22 09:47:36 -06:00
2018-11-07 13:44:59 -07:00
2018-11-07 13:44:59 -07:00
2019-02-01 20:55:38 +01:00
2019-04-22 09:47:36 -06:00
2018-08-22 10:52:48 -07:00
2019-03-18 07:07:30 +01:00
2018-11-13 21:55:24 +01:00
2019-02-28 03:28:53 -05:00
2019-03-12 18:59:17 -07:00
2019-02-28 08:24:23 -07:00
2018-12-19 10:42:08 +01:00
2018-07-27 09:57:23 +10:00
2019-03-12 10:04:02 -07:00
2019-04-22 09:48:12 -06:00
2019-03-05 21:07:16 -08:00
2019-02-15 16:54:38 +01:00
2019-03-12 10:04:00 -07:00
2018-10-21 10:46:33 -04:00
2018-12-07 12:59:08 -08:00
2019-03-09 19:52:47 -08:00
2018-11-07 13:42:32 -07:00
2019-02-24 08:20:17 -07:00
2018-11-19 19:03:46 -07:00
2018-12-06 13:57:03 +01:00
2019-04-16 15:38:07 +02:00
2018-11-30 13:29:04 +00:00
2019-01-11 20:51:24 +01:00
2019-03-07 18:32:03 -08:00
2019-01-04 13:13:48 -08:00
2019-01-30 20:51:47 -05:00
2018-10-17 13:56:58 -07:00
2019-03-15 15:29:47 -07:00
2019-02-20 07:22:17 -07:00
2019-02-20 07:22:10 -07:00
2018-12-06 15:45:46 +01:00
2019-02-08 15:02:49 -08:00
2019-03-05 21:07:19 -08:00
2018-10-21 10:46:39 -04:00
2018-09-18 17:52:15 -05:00
2018-07-19 11:34:23 +01:00
2018-10-26 16:26:35 -07:00
2019-03-03 21:47:57 -08:00
2018-10-08 22:53:10 +11:00
2019-03-12 10:04:03 -07:00
2018-12-03 17:11:02 -08:00
2018-07-20 01:11:45 +02:00
2018-08-02 17:33:06 -04:00
2019-01-07 16:38:26 +01:00
2019-02-25 21:20:45 +01:00
2018-09-25 20:17:35 -07:00
2019-03-15 15:29:47 -07:00
2018-08-16 12:14:42 -07:00
2019-02-07 16:38:35 +01:00
2019-04-05 16:02:30 -10:00
2018-09-29 22:47:49 -04:00
2018-10-11 09:16:44 -07:00
2019-02-07 00:13:27 +01:00
2018-12-10 10:17:45 +01:00
2019-04-06 10:48:35 -06:00
2018-09-25 20:33:24 +02:00
2019-01-11 18:05:40 -08:00
2019-02-26 12:53:55 +01:00
2018-09-11 14:11:51 +02:00
2018-12-22 12:15:29 +01:00