* [PATCH] blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()
@ 2021-09-07 12:12 ` Li Jinlin
0 siblings, 0 replies; 3+ messages in thread
From: Li Jinlin @ 2021-09-07 12:12 UTC (permalink / raw)
To: tj, axboe; +Cc: cgroups, linux-block, linux-kernel, linfeilong, louhongxiang
From: Li Jinlin <lijinlin3@huawei.com>
The pending timer has been set up in blk_throtl_init(). However, the
timer is not deleted in blk_throtl_exit(). This means that the timer
handler may still be running after freeing the timer, which would
result in a use-after-free.
Fix by calling del_timer_sync() to delete the timer in blk_throtl_exit().
Signed-off-by: Li Jinlin <lijinlin3@huawei.com>
---
block/blk-throttle.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 55c49015e533..dbe49e181a88 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -2458,6 +2458,7 @@ int blk_throtl_init(struct request_queue *q)
void blk_throtl_exit(struct request_queue *q)
{
BUG_ON(!q->td);
+ del_timer_sync(&q->td->service_queue.pending_timer);
throtl_shutdown_wq(q);
blkcg_deactivate_policy(q, &blkcg_policy_throtl);
free_percpu(q->td->latency_buckets[READ]);
--
2.27.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH] blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()
@ 2021-09-07 12:12 ` Li Jinlin
0 siblings, 0 replies; 3+ messages in thread
From: Li Jinlin @ 2021-09-07 12:12 UTC (permalink / raw)
To: tj, axboe; +Cc: cgroups, linux-block, linux-kernel, linfeilong, louhongxiang
From: Li Jinlin <lijinlin3@huawei.com>
The pending timer has been set up in blk_throtl_init(). However, the
timer is not deleted in blk_throtl_exit(). This means that the timer
handler may still be running after freeing the timer, which would
result in a use-after-free.
Fix by calling del_timer_sync() to delete the timer in blk_throtl_exit().
Signed-off-by: Li Jinlin <lijinlin3@huawei.com>
---
block/blk-throttle.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 55c49015e533..dbe49e181a88 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -2458,6 +2458,7 @@ int blk_throtl_init(struct request_queue *q)
void blk_throtl_exit(struct request_queue *q)
{
BUG_ON(!q->td);
+ del_timer_sync(&q->td->service_queue.pending_timer);
throtl_shutdown_wq(q);
blkcg_deactivate_policy(q, &blkcg_policy_throtl);
free_percpu(q->td->latency_buckets[READ]);
--
2.27.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()
2021-09-07 12:12 ` Li Jinlin
(?)
@ 2021-09-07 14:37 ` Jens Axboe
-1 siblings, 0 replies; 3+ messages in thread
From: Jens Axboe @ 2021-09-07 14:37 UTC (permalink / raw)
To: Li Jinlin, tj
Cc: cgroups, linux-block, linux-kernel, linfeilong, louhongxiang
On 9/7/21 6:12 AM, Li Jinlin wrote:
> From: Li Jinlin <lijinlin3@huawei.com>
>
> The pending timer has been set up in blk_throtl_init(). However, the
> timer is not deleted in blk_throtl_exit(). This means that the timer
> handler may still be running after freeing the timer, which would
> result in a use-after-free.
>
> Fix by calling del_timer_sync() to delete the timer in blk_throtl_exit().
Applied, thanks.
--
Jens Axboe
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-09-07 14:37 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-07 12:12 [PATCH] blk-throttle: fix UAF by deleteing timer in blk_throtl_exit() Li Jinlin
2021-09-07 12:12 ` Li Jinlin
2021-09-07 14:37 ` Jens Axboe
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.