linux-kernel - Re: paride/pf.c: blk-mq use-after-free (kernel v5.0)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <fd6d1a5e-25d1-c05c-9b03-837300f8935f@kernel.dk>
Date:   Mon, 18 Mar 2019 08:08:06 -0600
From:   Jens Axboe <axboe@...nel.dk>
To:     Randy Dunlap <rdunlap@...radead.org>,
        linux-block <linux-block@...r.kernel.org>
Cc:     LKML <linux-kernel@...r.kernel.org>, Tim Waugh <tim@...erelk.net>,
        linux-parport@...ts.infradead.org
Subject: Re: paride/pf.c: blk-mq use-after-free (kernel v5.0)

On 3/16/19 5:48 PM, Randy Dunlap wrote:
> On 3/16/19 12:31 PM, Jens Axboe wrote:
>> On 3/15/19 6:32 PM, Randy Dunlap wrote:
>>> On 3/15/19 9:33 AM, Jens Axboe wrote:
>>>> On 3/14/19 5:49 PM, Randy Dunlap wrote:
>>>>> On 3/14/19 4:43 PM, Jens Axboe wrote:
>>>>>> On 3/13/19 5:09 PM, Randy Dunlap wrote:
>>>>>>> On 3/11/19 6:34 PM, Randy Dunlap wrote:
>>>>>>>> On 3/11/19 6:25 PM, Randy Dunlap wrote:
>>>>>>>>> [Has this already been addressed/fixed?]>>
>>>>>>>>
>>>>>>>> Same bug occurs with paride/pcd.c driver.
>>>>>>>
>>>>>>> This still happens (in blk-mq) in v5.0-11053-gebc551f2b8f9 of Mar. 12, 2019,
>>>>>>> around 4pm PT.  [caused by paride: pf.c and pcd.c)
>>>>>>
>>>>>> I'll take a look at this, been busy with other stuff. How are you
>>>>>> reproducing this? I'm assuming you don't actually have any hardware :-)
>>>>>
>>>>> Right.  I just load the module (pf or pcd), unload it, and
>>>>> then load it again.
>>>>
>>>> Does this work?
>>>>
>>>
>>> No.  Just loading the pf module gives this:
>>
>> Missing clear of the queue. This one should be more complete.
>>
>> To be fair, this was utterly broken since forever. It's just now apparent
>> since we complain about it. But pf/pcd was one big leak fest.
>>
> 
> OK, this one works for both pf and pcd.
> By "works" I mean that the driver init function runs and exits without
> causing a BUG or GP fault etc.
> Not that I have any such hardware.
> 
> Tested-by: Randy Dunlap <rdunlap@...radead.org>

Thanks Randy, I'll get these queued up.

-- 
Jens Axboe