Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1372095

Re: [PATCH] [RFC] fix potential access after free: return value of blk_check_plugged() must be used schedule() safe

Show all headers | View raw

On Tue, Apr 05, 2016 at 03:36:57PM +0200, Lars Ellenberg wrote:
> blk_check_plugged() will return a pointer
> to an object linked on current->plug->cb_list.
> 
> That list may "at any time" be implicitly cleared by
> blk_flush_plug_list()
>  flush_plug_callbacks()
> either as a result of blk_finish_plug(),
> or implicitly by schedule() [and maybe other implicit mechanisms?]
> 
> If there is no protection against an implicit unplug
> between the call to blk_check_plug() and using its return value,
> that implicit unplug may have already happened,
> even before the plug is actually initialized or populated,
> and we may be using a pointer to already free()d data.
> 
> I suggest that both raid1 and raid10 can easily be fixed
> by moving the call to blk_check_plugged() inside the spinlock.
> 
> For md/raid5 and btrfs/raid56,
> I'm unsure how (if) this needs to be fixed.

I think you're right, digging in to see if there's something I missed.
But as Neil said, it looks like we just got saved by preemption being
off by default.

-chris

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] [RFC] fix potential access after free: return value of  blk_check_plugged() must be used schedule() safe Lars Ellenberg <lars.ellenberg@linbit.com> - 2016-04-05 15:40 +0200
  Re: [PATCH] [RFC] fix potential access after free: return value of blk_check_plugged() must be used schedule() safe NeilBrown <neilb@suse.de> - 2016-04-06 01:00 +0200
  Re: [PATCH] [RFC] fix potential access after free: return value of  blk_check_plugged() must be used schedule() safe Chris Mason <clm@fb.com> - 2016-04-06 02:40 +0200
  Re: [PATCH] [RFC] fix potential access after free: return value of  blk_check_plugged() must be used schedule() safe Shaohua Li <shli@kernel.org> - 2016-04-06 03:00 +0200
    Re: [PATCH] [RFC] fix potential access after free: return value of blk_check_plugged() must be used schedule() safe NeilBrown <neilb@suse.de> - 2016-04-06 05:20 +0200
      Re: [PATCH] [RFC] fix potential access after free: return value of  blk_check_plugged() must be used schedule() safe Lars Ellenberg <lars.ellenberg@linbit.com> - 2016-04-06 14:10 +0200

csiph-web