[prev in list] [next in list] [prev in thread] [next in thread]
List: linux-block
Subject: Re: [PATCH] bdev: fix NULL pointer dereference in sync()/close() race
From: Tejun Heo <tj () kernel ! org>
Date: 2016-08-29 23:49:29
Message-ID: 20160829234929.GJ28713 () mtj ! duckdns ! org
[Download RAW message or body]
Hello,
On Mon, Aug 29, 2016 at 11:33:41PM +0200, Vegard Nossum wrote:
> On 08/29/2016 09:55 PM, Tejun Heo wrote:
> > I think the right thing to do there is doing blkdev_get() /
> > blkdev_put() around func() invocation in iterate_bdevs() rather than
> > holding bd_mutex across the callback. Can you please verify whether
> > that works?
>
> Didn't work for me, I kept getting use-after-free in __blkdev_get() on
> bdev->bd_invalidated after it calls bdev->bd_disk->fops->open(). I tried
> a few related things without much luck.
I see. It could be that it's doing blkdev_get() on a dying device.
> The only thing that worked for me without holding the mutex across the
> call was this:
...
> + mutex_lock(&bdev->bd_mutex);
> + bdev->bd_openers++;
> + bdev->bd_holders++;
> + mutex_unlock(&bdev->bd_mutex);
> +
> + func(bdev, arg);
> +
> + mutex_lock(&bdev->bd_mutex);
> + bdev->bd_openers--;
> + bdev->bd_holders--;
> + mutex_unlock(&bdev->bd_mutex);
And this might not be too far fetched. I think what we want is
* Bump bd_openers if there are other users already; otherwise, skip.
* blkdev_put() after the callback is finished.
Thanks.
--
tejun
--
To unsubscribe from this list: send the line "unsubscribe linux-block" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic