Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Jens Axboe <axboe@kernel.dk>
To:     mingo@redhat.com, rostedt@goodmis.org, gregkh@linuxfoundation.org,
        Yu Kuai <yukuai3@huawei.com>
Cc:     linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
        yi.zhang@huawei.com
In-Reply-To: <20220228034354.4047385-1-yukuai3@huawei.com>
References: <20220228034354.4047385-1-yukuai3@huawei.com>
Subject: Re: [PATCH v2] blktrace: fix use after free for struct blk_trace
Message-Id: <164605542062.3958.11033668942703223709.b4-ty@kernel.dk>
Date:   Mon, 28 Feb 2022 06:37:00 -0700
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Precedence: bulk

On Mon, 28 Feb 2022 11:43:54 +0800, Yu Kuai wrote:
> When tracing the whole disk, 'dropped' and 'msg' will be created
> under 'q->debugfs_dir' and 'bt->dir' is NULL, thus blk_trace_free()
> won't remove those files. What's worse, the following UAF can be
> triggered because of accessing stale 'dropped' and 'msg':
> 
> ==================================================================
> BUG: KASAN: use-after-free in blk_dropped_read+0x89/0x100
> Read of size 4 at addr ffff88816912f3d8 by task blktrace/1188
> 
> [...]

Applied, thanks!

[1/1] blktrace: fix use after free for struct blk_trace
      commit: 30939293262eb433c960c4532a0d59c4073b2b84

Best regards,
-- 
Jens Axboe