linux-kernel - Re: [PATCH v2] writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f58a438f-12e2-b3e2-2397-88a56e29d2b3@huawei.com>
Date:   Tue, 11 Apr 2023 12:09:17 +0800
From:   Baokun Li <libaokun1@...wei.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
CC:     <linux-fsdevel@...r.kernel.org>, <viro@...iv.linux.org.uk>,
        <brauner@...nel.org>, <jack@...e.cz>, <tj@...nel.org>,
        <dennis@...nel.org>, <adilger.kernel@...ger.ca>,
        <linux-kernel@...r.kernel.org>, <yi.zhang@...wei.com>,
        <yangerkun@...wei.com>, <houtao1@...wei.com>,
        <stable@...r.kernel.org>, Baokun Li <libaokun1@...wei.com>
Subject: Re: [PATCH v2] writeback, cgroup: fix null-ptr-deref write in
 bdi_split_work_to_wbs

On 2023/4/11 11:53, Andrew Morton wrote:
> On Mon, 10 Apr 2023 21:08:26 +0800 Baokun Li <libaokun1@...wei.com> wrote:
>
>> ...
>>
>> To solve this problem, percpu_ref_exit() is called under RCU protection
>> to avoid race between cgwb_release_workfn() and bdi_split_work_to_wbs().
>> Moreover, replace wb_get() with wb_tryget() in bdi_split_work_to_wbs(),
>> and skip the current wb if wb_tryget() fails because the wb has already
>> been shutdown.
>>
>> Fixes: b817525a4a80 ("writeback: bdi_writeback iteration must not skip dying ones")
>> Fixes: f3b6a6df38aa ("writeback, cgroup: keep list of inodes attached to bdi_writeback")
> Two Fixes: is awkward.  The Fixes: serves a guide to which kernel
> versions should be patched, but those two commits are six years apart.
>
> So... how far back should this fix be backported?
This issue was introduced in v4.3-rc7 by commit b817525a4a80 
("writeback: bdi_writeback iteration
must not skip dying ones"), so anything that has this commit 
incorporated is problematic.

Another fix tag patch invalidates a previously unintentional fix, and 
then the problem becomes more
easily reproducible. This fix tag can actually be removed, and is added 
here so that people who see
the patch will know what happened.

-- 
With Best Regards,
Baokun Li
.