Messages in this thread | | | Date | Wed, 15 Mar 2023 09:30:26 +0100 | Subject | Re: [PATCH v2 0/5] md: fix uaf for sync_thread | From | Paul Menzel <> |
| |
Dear Logan,
Am 15.03.23 um 07:18 schrieb Yu Kuai: > From: Yu Kuai <yukuai3@huawei.com> > > Changes in v2: > - fix a compile error for for md-cluster in patch 2 > - replace spin_lock/unlock with spin_lock/unlock_irq in patch 5 > - don't wake up inside the new lock in md wakeup_thread in patch 5 > > Our test reports a uaf for 'mddev->sync_thread': > > T1 T2 > md_start_sync > md_register_thread > raid1d > md_check_recovery > md_reap_sync_thread > md_unregister_thread > kfree > > md_wakeup_thread > wake_up > ->sync_thread was freed > > Currently, a global spinlock 'pers_lock' is borrowed to protect > 'mddev->thread', this problem can be fixed likewise, however, there might > be similar problem for other md_thread, and I really don't like the idea to > borrow a global lock. > > This patchset do some refactor, and then use a disk level spinlock to > protect md_thread in relevant apis. > > I tested this pathset with mdadm tests, and there are no new regression, > by the way, following test will failed with or without this patchset: > > 01raid6integ > 04r1update > 05r6tor0 > 10ddf-create > 10ddf-fail-spare > 10ddf-fail-stop-readd > 10ddf-geometry
As you improved the tests in the past, can you confirm, these failed on your test systems too and are fixed now?
[…]
Kind regards,
Paul
| |