linux-kernel - Re: [PATCH 4.19 130/276] block: fix use-after-free on gendisk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <41301531-6619-8230-b016-ef32dd3e07e9@acm.org>
Date:   Sat, 1 Jun 2019 07:25:09 -0700
From:   Bart Van Assche <bvanassche@....org>
To:     Pavel Machek <pavel@....cz>
Cc:     linux-kernel@...r.kernel.org, Al Viro <viro@...iv.linux.org.uk>,
        Keith Busch <keith.busch@...el.com>, Jan Kara <jack@...e.cz>,
        Yufen Yu <yuyufen@...wei.com>, Jens Axboe <axboe@...nel.dk>,
        Sasha Levin <sashal@...nel.org>
Subject: Re: [PATCH 4.19 130/276] block: fix use-after-free on gendisk

On 6/1/19 12:27 AM, Pavel Machek wrote:
> Hi!
> 
>> +++ b/block/genhd.c
>> @@ -518,6 +518,18 @@ void blk_free_devt(dev_t devt)
>>  	}
>>  }
>>  
>> +/**
>> + *	We invalidate devt by assigning NULL pointer for devt in idr.
>> + */
>> +void blk_invalidate_devt(dev_t devt)
>> +{
>> +	if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
>> +		spin_lock_bh(&ext_devt_lock);
>> +		idr_replace(&ext_devt_idr, NULL, blk_mangle_minor(MINOR(devt)));
>> +		spin_unlock_bh(&ext_devt_lock);
>> +	}
>> +}
>> +
> 
> AFAICT /** means linuxdoc, but the comment does not have required
> format. Probably should be just /*.

Agreed. A fix has been queued in Jens' tree. See also commit
33c826ef19df ("block: Convert blk_invalidate_devt() header into a
non-kernel-doc header").

Bart.