linux-kernel - Re: block: Fix oops caused by __blkdev_get() calling disk_unblock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D77C664.3080803@fusionio.com>
Date:	Wed, 9 Mar 2011 19:26:44 +0100
From:	Jens Axboe <jaxboe@...ionio.com>
To:	Tejun Heo <tj@...nel.org>
CC:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"kay.sievers@...y.org" <kay.sievers@...y.org>,
	"hch@...radead.org" <hch@...radead.org>
Subject: Re: block: Fix oops caused by __blkdev_get() calling  disk_unblock_events()
 with invalid @disk

On 2011-03-09 16:38, Tejun Heo wrote:
> Commit 57c966b8b2 (block: Don't check events while open is in
> progress) made __blkdev_get() block events around open calls; however,
> it used invalid @disk pointer in the following cases.
> 
> * When ->open() returns -ERESTARTSYS, disk_unblock_events() is called
>   after @disk is put.  @disk may be invalid by the time unblock is
>   called.
> 
>   This is fixed by moving references after disk_unblock_events().
> 
> * When there are multiple openers, @disk is cleared to %NULL and later
>   disk_unblock_disk() is called with %NULL @disk causing oops.
> 
>   This is fixed by moving reference putting after open success is
>   determined and not clearing @disk to %NULL.  On success, @disk is
>   valid because there is another opener holding reference to it.  On
>   failure, the references are put after disk_unblock_events() is
>   called.

Thanks, applied. A bit unfortunate to have a 100% crasher in the tree,
though. Will suck for bisects.

-- 
Jens Axboe

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/