summaryrefslogtreecommitdiffstats
path: root/include/linux/genhd.h
diff options
context:
space:
mode:
authorYufen Yu2019-04-02 14:06:34 +0200
committerJens Axboe2019-04-22 17:48:12 +0200
commit6fcc44d1d77fea3c7230e4d109b37f6977aa675a (patch)
tree2fb40867aa291075313719bd9bb5f8874c5bca96 /include/linux/genhd.h
parentMerge tag 'v5.1-rc6' into for-5.2/block (diff)
downloadkernel-qcow2-linux-6fcc44d1d77fea3c7230e4d109b37f6977aa675a.tar.gz
kernel-qcow2-linux-6fcc44d1d77fea3c7230e4d109b37f6977aa675a.tar.xz
kernel-qcow2-linux-6fcc44d1d77fea3c7230e4d109b37f6977aa675a.zip
block: fix use-after-free on gendisk
commit 2da78092dda "block: Fix dev_t minor allocation lifetime" specifically moved blk_free_devt(dev->devt) call to part_release() to avoid reallocating device number before the device is fully shutdown. However, it can cause use-after-free on gendisk in get_gendisk(). We use md device as example to show the race scenes: Process1 Worker Process2 md_free blkdev_open del_gendisk add delete_partition_work_fn() to wq __blkdev_get get_gendisk put_disk disk_release kfree(disk) find part from ext_devt_idr get_disk_and_module(disk) cause use after free delete_partition_work_fn put_device(part) part_release remove part from ext_devt_idr Before <devt, hd_struct pointer> is removed from ext_devt_idr by delete_partition_work_fn(), we can find the devt and then access gendisk by hd_struct pointer. But, if we access the gendisk after it have been freed, it can cause in use-after-freeon gendisk in get_gendisk(). We fix this by adding a new helper blk_invalidate_devt() in delete_partition() and del_gendisk(). It replaces hd_struct pointer in idr with value 'NULL', and deletes the entry from idr in part_release() as we do now. Thanks to Jan Kara for providing the solution and more clear comments for the code. Fixes: 2da78092dda1 ("block: Fix dev_t minor allocation lifetime") Cc: Al Viro <viro@zeniv.linux.org.uk> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Keith Busch <keith.busch@intel.com> Reviewed-by: Jan Kara <jack@suse.cz> Suggested-by: Jan Kara <jack@suse.cz> Signed-off-by: Yufen Yu <yuyufen@huawei.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'include/linux/genhd.h')
-rw-r--r--include/linux/genhd.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index 6547c9256d5c..8b5330dd5ac0 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -617,6 +617,7 @@ struct unixware_disklabel {
extern int blk_alloc_devt(struct hd_struct *part, dev_t *devt);
extern void blk_free_devt(dev_t devt);
+extern void blk_invalidate_devt(dev_t devt);
extern dev_t blk_lookup_devt(const char *name, int partno);
extern char *disk_name (struct gendisk *hd, int partno, char *buf);