[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20230315061810.653263-1-yukuai1@huaweicloud.com>
Date: Wed, 15 Mar 2023 14:18:05 +0800
From: Yu Kuai <yukuai1@...weicloud.com>
To: agk@...hat.com, snitzer@...nel.org, song@...nel.org
Cc: linux-kernel@...r.kernel.org, linux-raid@...r.kernel.org,
yukuai3@...wei.com, yukuai1@...weicloud.com, yi.zhang@...wei.com,
yangerkun@...wei.com
Subject: [PATCH v2 0/5] md: fix uaf for sync_thread
From: Yu Kuai <yukuai3@...wei.com>
Changes in v2:
- fix a compile error for for md-cluster in patch 2
- replace spin_lock/unlock with spin_lock/unlock_irq in patch 5
- don't wake up inside the new lock in md wakeup_thread in patch 5
Our test reports a uaf for 'mddev->sync_thread':
T1 T2
md_start_sync
md_register_thread
raid1d
md_check_recovery
md_reap_sync_thread
md_unregister_thread
kfree
md_wakeup_thread
wake_up
->sync_thread was freed
Currently, a global spinlock 'pers_lock' is borrowed to protect
'mddev->thread', this problem can be fixed likewise, however, there might
be similar problem for other md_thread, and I really don't like the idea to
borrow a global lock.
This patchset do some refactor, and then use a disk level spinlock to
protect md_thread in relevant apis.
I tested this pathset with mdadm tests, and there are no new regression,
by the way, following test will failed with or without this patchset:
01raid6integ
04r1update
05r6tor0
10ddf-create
10ddf-fail-spare
10ddf-fail-stop-readd
10ddf-geometry
Yu Kuai (5):
md: pass a md_thread pointer to md_register_thread()
md: refactor md_wakeup_thread()
md: use md_thread api to wake up sync_thread
md: pass a mddev to md_unregister_thread()
md: protect md_thread with a new disk level spin lock
drivers/md/dm-raid.c | 6 +-
drivers/md/md-bitmap.c | 6 +-
drivers/md/md-cluster.c | 39 +++++----
drivers/md/md-multipath.c | 8 +-
drivers/md/md.c | 162 ++++++++++++++++++++------------------
drivers/md/md.h | 15 ++--
drivers/md/raid1.c | 19 +++--
drivers/md/raid10.c | 31 ++++----
drivers/md/raid5-cache.c | 19 +++--
drivers/md/raid5-ppl.c | 2 +-
drivers/md/raid5.c | 48 ++++++-----
11 files changed, 177 insertions(+), 178 deletions(-)
--
2.31.1
Powered by blists - more mailing lists