linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Jan Kara <jack@suse.cz>
To: Christoph Hellwig <hch@lst.de>
Cc: axboe@kernel.dk, yuyufen@huawei.com, tj@kernel.org, jack@suse.cz,
	bvanassche@acm.org, tytso@mit.edu, gregkh@linuxfoundation.org,
	linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 3/8] bdi: add a ->dev_name field to struct backing_dev_info
Date: Fri, 17 Apr 2020 10:59:09 +0200	[thread overview]
Message-ID: <20200417085909.GA12234@quack2.suse.cz> (raw)
In-Reply-To: <20200416165453.1080463-4-hch@lst.de>

On Thu 16-04-20 18:54:48, Christoph Hellwig wrote:
> Cache a copy of the name for the life time of the backing_dev_info
> structure so that we can reference it even after unregistering.
> 
> Fixes: 68f23b89067f ("memcg: fix a crash in wb_workfn when a device disappears")
> Reported-by: Yufen Yu <yuyufen@huawei.com>
> Signed-off-by: Christoph Hellwig <hch@lst.de>

...

> @@ -938,7 +938,8 @@ int bdi_register_va(struct backing_dev_info *bdi, const char *fmt, va_list args)
>  	if (bdi->dev)	/* The driver needs to use separate queues per device */
>  		return 0;
>  
> -	dev = device_create_vargs(bdi_class, NULL, MKDEV(0, 0), bdi, fmt, args);
> +	vsnprintf(bdi->dev_name, sizeof(bdi->dev_name), fmt, args);
> +	dev = device_create(bdi_class, NULL, MKDEV(0, 0), bdi, bdi->dev_name);
>  	if (IS_ERR(dev))
>  		return PTR_ERR(dev);
>  

This can have a sideeffect not only bdi->dev_name will be truncated to 64
chars (which generally doesn't matter) but possibly also kobject name will
be truncated in the same way.  Which may have user visible effects. E.g.
for fs/vboxsf 64 chars need not be enough. So shouldn't we rather do it the
other way around - i.e., let device_create_vargs() create the device name
and then copy to bdi->dev_name whatever fits?

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

  reply	other threads:[~2020-04-17  8:59 UTC|newest]

Thread overview: 34+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-16 16:54 bdi: fix use-after-free for dev_name(bdi->dev) v2 Christoph Hellwig
2020-04-16 16:54 ` [PATCH 1/8] bdi: move bdi_dev_name out of line Christoph Hellwig
2020-04-18 15:35   ` Bart Van Assche
2020-04-16 16:54 ` [PATCH 2/8] bdi: use bdi_dev_name() to get device name Christoph Hellwig
2020-04-18 15:37   ` Bart Van Assche
2020-04-16 16:54 ` [PATCH 3/8] bdi: add a ->dev_name field to struct backing_dev_info Christoph Hellwig
2020-04-17  8:59   ` Jan Kara [this message]
2020-04-17 13:01     ` Christoph Hellwig
2020-04-20 11:41       ` Hans de Goede
2020-04-20 11:58         ` Christoph Hellwig
2020-04-21 12:42           ` Hans de Goede
2020-04-18 15:40     ` Bart Van Assche
2020-04-19  7:58       ` Christoph Hellwig
2020-04-19 15:29         ` Bart Van Assche
2020-04-19 16:06           ` Christoph Hellwig
2020-04-20  7:48             ` Christoph Hellwig
2020-04-20  9:52               ` Jan Kara
2020-04-20  9:49             ` Jan Kara
2020-04-16 16:54 ` [PATCH 4/8] driver core: remove device_create_vargs Christoph Hellwig
2020-04-16 16:54 ` [PATCH 5/8] bdi: unexport bdi_register_va Christoph Hellwig
2020-04-18 15:41   ` Bart Van Assche
2020-04-16 16:54 ` [PATCH 6/8] bdi: remove bdi_register_owner Christoph Hellwig
2020-04-18 15:43   ` Bart Van Assche
2020-04-16 16:54 ` [PATCH 7/8] bdi: simplify bdi_alloc Christoph Hellwig
2020-04-18 15:44   ` Bart Van Assche
2020-04-16 16:54 ` [PATCH 8/8] bdi: remove the name field in struct backing_dev_info Christoph Hellwig
2020-04-18 15:45   ` Bart Van Assche
  -- strict thread matches above, loose matches on Subject: below --
2020-04-16  7:15 bdi: fix use-after-free for dev_name(bdi->dev) Christoph Hellwig
2020-04-16  7:15 ` [PATCH 3/8] bdi: add a ->dev_name field to struct backing_dev_info Christoph Hellwig
2020-04-16  7:52   ` Greg KH
2020-04-16  8:34   ` Yufen Yu
2020-04-16 12:02     ` Jan Kara
2020-04-16 12:19       ` Christoph Hellwig
2020-04-16 12:22         ` Christoph Hellwig
2020-04-16 12:31           ` Jan Kara

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200417085909.GA12234@quack2.suse.cz \
    --to=jack@suse.cz \
    --cc=axboe@kernel.dk \
    --cc=bvanassche@acm.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=hch@lst.de \
    --cc=linux-block@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=tj@kernel.org \
    --cc=tytso@mit.edu \
    --cc=yuyufen@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).