From: John Garry <john.garry@huawei.com>
To: <axboe@kernel.dk>, <ming.lei@redhat.com>
Cc: <linux-block@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<hch@lst.de>, <hare@suse.de>, <ppvk@codeaurora.org>,
<bvanassche@acm.org>, <kashyap.desai@broadcom.com>,
<linuxarm@huawei.com>, John Garry <john.garry@huawei.com>
Subject: [RFC PATCH v2 0/2] blk-mq: Avoid use-after-free for accessing old requests
Date: Thu, 17 Dec 2020 19:07:51 +0800 [thread overview]
Message-ID: <1608203273-170555-1-git-send-email-john.garry@huawei.com> (raw)
This series aims to tackle the various UAF reports, like:
- https://lore.kernel.org/linux-block/8376443a-ec1b-0cef-8244-ed584b96fa96@huawei.com/
- https://lore.kernel.org/linux-block/5c3ac5af-ed81-11e4-fee3-f92175f14daf@acm.org/T/#m6c1ac11540522716f645d004e2a5a13c9f218908
- https://lore.kernel.org/linux-block/04e2f9e8-79fa-f1cb-ab23-4a15bf3f64cc@kernel.dk/
Details are in the commit messages. Most important detail is that
fastpath is untouched.
The issue addressed in patch 1/2 is pretty easy to reproduce, 2/2 not so
much.
Differences to v1:
- add 2nd patch
John Garry (2):
blk-mq: Clean up references to old requests when freeing rqs
blk-mq: Lockout tagset iter when freeing rqs
block/blk-mq-sched.c | 2 +-
block/blk-mq-tag.c | 22 +++++++++++++++++++---
block/blk-mq-tag.h | 3 +++
block/blk-mq.c | 22 ++++++++++++++++++++--
block/blk-mq.h | 2 ++
5 files changed, 45 insertions(+), 6 deletions(-)
--
2.26.2
next reply other threads:[~2020-12-17 11:12 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-17 11:07 John Garry [this message]
2020-12-17 11:07 ` [RFC PATCH v2 1/2] blk-mq: Clean up references to old requests when freeing rqs John Garry
2020-12-17 11:07 ` [RFC PATCH v2 2/2] blk-mq: Lockout tagset iter " John Garry
2020-12-18 1:55 ` Bart Van Assche
2020-12-18 9:30 ` John Garry
2020-12-18 3:31 ` Ming Lei
2020-12-18 10:01 ` John Garry
2020-12-18 22:43 ` Bart Van Assche
2020-12-21 12:06 ` John Garry
2020-12-21 18:09 ` Bart Van Assche
2020-12-21 18:47 ` John Garry
2020-12-22 2:13 ` Bart Van Assche
2020-12-22 11:15 ` John Garry
2020-12-22 16:16 ` Bart Van Assche
2020-12-23 11:10 ` John Garry
2020-12-23 11:40 ` John Garry
2020-12-23 15:47 ` Bart Van Assche
2021-01-04 15:33 ` John Garry
2021-01-04 17:22 ` Bart Van Assche
2021-01-04 18:43 ` John Garry
[not found] ` <760304b3-dcbc-5b9d-0c70-627b7ff5b4eb@huawei.com>
2021-02-10 14:39 ` John Garry
2020-12-22 11:22 ` John Garry
2020-12-22 13:24 ` Ming Lei
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1608203273-170555-1-git-send-email-john.garry@huawei.com \
--to=john.garry@huawei.com \
--cc=axboe@kernel.dk \
--cc=bvanassche@acm.org \
--cc=hare@suse.de \
--cc=hch@lst.de \
--cc=kashyap.desai@broadcom.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxarm@huawei.com \
--cc=ming.lei@redhat.com \
--cc=ppvk@codeaurora.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®