lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Sat, 16 May 2020 03:19:49 +0000
From:   Luis Chamberlain <>
Cc:,,,,,, Luis Chamberlain <>
Subject: [PATCH v5 0/7] block: fix blktrace debugfs use after free

On this v5 I've split up the first patch into 3, one for comments,
another for context / might_sleep() updates, and the last the big
revert back to synchronous request_queue removal. I didn't update
the context for the put / decrements for gendisk & request_queue
as they would be updated in the next patch.

Since the first 3 patches are a reflection of the original one, I've
left the Reviewed-by's collected in place.

I've changed the kzalloc() / snprintf() to just kasprintf() as requested
by Bart. Since it was not clear that we don't have the bdev on
do_blk_trace_setup() for the patch titled "blktrace: break out of
blktrace setup on concurrent calls", I've added a comment so that
someone doesn't later try to add a dev_printk() or the like.

I've also addressed a compilation issue with debugfs disabled reported
by 0-day on the patch titled "blktrace: fix debugfs use after free". It
was missing a "static inline" on a function. I've also moved the new
declarations underneath the "#ifdef CONFIG_BLOCK" on include/linux/genhd.h,
I previously had them outside of this block.

I've left in place the scsi-generic blktrace suppport given I didn't receive any
feedback to kill it. This ensures this works as it used to.

Since these are minor changes I've given this a spin with break-blktrace
tests I have written and also ran blktrace with a scsi-generic media
changer. Both sg0 (the controller) and sg1 worked as expected.

These changes are based on linux-next tag next-20200515, and can also be
found on my git tree:

Luis Chamberlain (7):
  block: add docs for gendisk / request_queue refcount helpers
  block: clarify context for gendisk / request_queue refcount increment
  block: revert back to synchronous request_queue removal
  block: move main block debugfs initialization to its own file
  blktrace: fix debugfs use after free
  blktrace: break out of blktrace setup on concurrent calls
  loop: be paranoid on exit and prevent new additions / removals

 block/Makefile               |  10 +-
 block/blk-core.c             |  32 ++++--
 block/blk-debugfs.c          | 197 +++++++++++++++++++++++++++++++++++
 block/blk-mq-debugfs.c       |   5 -
 block/blk-sysfs.c            |  46 ++++----
 block/blk.h                  |  24 +++++
 block/bsg.c                  |   2 +
 block/genhd.c                |  73 ++++++++++++-
 block/partitions/core.c      |   9 ++
 drivers/block/loop.c         |   4 +
 drivers/scsi/ch.c            |   1 +
 drivers/scsi/sg.c            |  75 +++++++++++++
 drivers/scsi/st.c            |   2 +
 include/linux/blkdev.h       |   6 +-
 include/linux/blktrace_api.h |   1 -
 include/linux/genhd.h        |  69 ++++++++++++
 kernel/trace/blktrace.c      |  37 +++++--
 17 files changed, 545 insertions(+), 48 deletions(-)
 create mode 100644 block/blk-debugfs.c


Powered by blists - more mailing lists