linux-kernel - Re: [PATCH] block: protect iterate_bdevs() against concurrent close

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160315082350.GA17942@quack.suse.cz>
Date:	Tue, 15 Mar 2016 09:23:50 +0100
From:	Jan Kara <jack@...e.cz>
To:	Rabin Vincent <rabin@....in>
Cc:	Jan Kara <jack@...e.cz>, Rabin Vincent <rabin.vincent@...s.com>,
	viro@...iv.linux.org.uk, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org, axboe@...nel.dk, hch@....de
Subject: Re: [PATCH] block: protect iterate_bdevs() against concurrent close

On Mon 14-03-16 18:42:58, Rabin Vincent wrote:
> (fixed Jens' address)
> 
> On Thu, Mar 10, 2016 at 06:37:27PM +0100, Jan Kara wrote:
> > On Thu 10-03-16 13:26:03, Rabin Vincent wrote:
> > > If a block device is closed while iterate_bdevs() is handling it, the
> > > following NULL pointer dereference occurs because bdev->b_disk is NULL
> > > in bdev_get_queue(), which is called from blk_get_backing_dev_info() (in
> > > turn called by the mapping_cap_writeback_dirty() call in
> > > __filemap_fdatawrite_range()):
> > 
> > Thanks for spotting the problem. The patch will fix the problem you
> > found.  But what prevents e.g. flusher thread from trying to writeback
> > the block device inode while that gets invalidated at the same moment?
> 
> Don't the sync_block_dev() / bdev_write_inode() calls in __blkdev_put()
> prevent this?

They don't. They make sure all dirty data is written but flusher thread can
still be in the middle of iteration over block device pages. So flusher
thread may still hold reference to the block device inode while
__blkdev_put() is done with it. Although flusher has nothing to write
anymore, it can still call some function where using inode_to_bdi() will
result in NULL pointer dereference...

								Honza
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR