linux-kernel - Re: [PATCH] nvme-core: remove head->effects to fix use-after-free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231117132846.GB7867@lst.de>
Date:   Fri, 17 Nov 2023 14:28:46 +0100
From:   Christoph Hellwig <hch@....de>
To:     Keith Busch <kbusch@...nel.org>
Cc:     Yuanyuan Zhong <yzhong@...estorage.com>,
        Jens Axboe <axboe@...nel.dk>, hch@....de, sagi@...mberg.me,
        linux-nvme@...ts.infradead.org, linux-kernel@...r.kernel.org,
        randyj@...estorage.com, hcoutinho@...estorage.com
Subject: Re: [PATCH] nvme-core: remove head->effects to fix use-after-free

On Wed, Nov 15, 2023 at 10:52:01PM -0500, Keith Busch wrote:
> 
> Yes, in section 5.16.1.6, "Commands Supported and Effects":
> 
>   This log page is used to describe the commands that the controller
>   supports and the effects of those commands on the state of the NVM
>   subsystem.
> 
> Oddly enough, Figure 202 says the scope of the log page is "Controller"
> rather than "Subsystem". Sounds like ECN potential. You can memcmp the
> effects log from each controller for a sanity check if you think some
> subsystem controllers messed that up.

If we really want to be 111% sure we could read the effects for all
controllers and do a logical OR of them, but I think the reason for the
per-controller scope is that for odd subsystems where different
controllers don't actually access the same namespaces these flags
could be different, i.e. one that only does KV, one that does ZNS,
one that does NVM and one that is just an administrative controller.