• J
    nbd: freeze the queue while we're adding connections · b98e762e
    Josef Bacik 提交于
    When setting up a device, we can krealloc the config->socks array to add
    new sockets to the configuration.  However if we happen to get a IO
    request in at this point even though we aren't setup we could hit a UAF,
    as we deref config->socks without any locking, assuming that the
    configuration was setup already and that ->socks is safe to access it as
    we have a reference on the configuration.
    
    But there's nothing really preventing IO from occurring at this point of
    the device setup, we don't want to incur the overhead of a lock to
    access ->socks when it will never change while the device is running.
    To fix this UAF scenario simply freeze the queue if we are adding
    sockets.  This will protect us from this particular case without adding
    any additional overhead for the normal running case.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: NJosef Bacik <josef@toxicpanda.com>
    Signed-off-by: NJens Axboe <axboe@kernel.dk>
    b98e762e
nbd.c 60.7 KB