From: Josef Bacik <josef@toxicpanda.com>
To: Ye Bin <yebin10@huawei.com>
Cc: axboe@kernel.dk, linux-block@vger.kernel.org,
nbd@other.debian.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH -next] nbd: Fix use-after-free in pid_show
Date: Wed, 20 Oct 2021 09:56:35 -0400 [thread overview]
Message-ID: <YXAgEyCjtQYkZA4A@localhost.localdomain> (raw)
In-Reply-To: <20211020073959.2679255-1-yebin10@huawei.com>
On Wed, Oct 20, 2021 at 03:39:59PM +0800, Ye Bin wrote:
> I got issue as follows:
> [ 263.886511] BUG: KASAN: use-after-free in pid_show+0x11f/0x13f
> [ 263.888359] Read of size 4 at addr ffff8880bf0648c0 by task cat/746
> [ 263.890479] CPU: 0 PID: 746 Comm: cat Not tainted 4.19.90-dirty #140
> [ 263.893162] Call Trace:
> [ 263.893509] dump_stack+0x108/0x15f
> [ 263.893999] print_address_description+0xa5/0x372
> [ 263.894641] kasan_report.cold+0x236/0x2a8
> [ 263.895696] __asan_report_load4_noabort+0x25/0x30
> [ 263.896365] pid_show+0x11f/0x13f
> [ 263.897422] dev_attr_show+0x48/0x90
> [ 263.898361] sysfs_kf_seq_show+0x24d/0x4b0
> [ 263.899479] kernfs_seq_show+0x14e/0x1b0
> [ 263.900029] seq_read+0x43f/0x1150
> [ 263.900499] kernfs_fop_read+0xc7/0x5a0
> [ 263.903764] vfs_read+0x113/0x350
> [ 263.904231] ksys_read+0x103/0x270
> [ 263.905230] __x64_sys_read+0x77/0xc0
> [ 263.906284] do_syscall_64+0x106/0x360
> [ 263.906797] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> Reproduce this issue as follows:
> 1. nbd-server 8000 /tmp/disk
> 2. nbd-client localhost 8000 /dev/nbd1
> 3. cat /sys/block/nbd1/pid
> Then trigger use-after-free in pid_show.
>
> Reason is after do step '2', nbd-client progress is already exit. So
> it's task_struct already freed.
> To solve this issue, revert part of 6521d39a64b3's modify and remove
> useless 'recv_task' member of nbd_device.
>
> Fixes: 6521d39a64b3 ("nbd: Remove variable 'pid'")
> Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Thanks,
Josef
next prev parent reply other threads:[~2021-10-20 13:56 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-20 7:39 [PATCH -next] nbd: Fix use-after-free in pid_show Ye Bin
2021-10-20 13:56 ` Josef Bacik [this message]
2021-10-20 14:10 ` Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YXAgEyCjtQYkZA4A@localhost.localdomain \
--to=josef@toxicpanda.com \
--cc=axboe@kernel.dk \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nbd@other.debian.org \
--cc=yebin10@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.