Re: [PATCH] nbd: defer config put in recv_work
- To: josef@toxicpanda.com, xiubli@redhat.com, Zheng Qixing <zhengqixing@huaweicloud.com>
- Cc: linux-block@vger.kernel.org, nbd@other.debian.org, linux-kernel@vger.kernel.org, yi.zhang@huawei.com, yangerkun@huawei.com, houtao1@huawei.com, linan122@h-partners.com, zhengqixing@huawei.com
- Subject: Re: [PATCH] nbd: defer config put in recv_work
- From: Jens Axboe <axboe@kernel.dk>
- Date: Sat, 08 Nov 2025 06:40:10 -0700
- Message-id: <[🔎] 176260921037.52069.3327906711798432611.b4-ty@kernel.dk>
- In-reply-to: <[🔎] 20251108070202.1816004-1-zhengqixing@huaweicloud.com>
- References: <[🔎] 20251108070202.1816004-1-zhengqixing@huaweicloud.com>
On Sat, 08 Nov 2025 15:02:02 +0800, Zheng Qixing wrote:
> There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and
> NBD_CMD_RECONFIGURE:
> nbd_genl_connect // conf_ref=2 (connect and recv_work A)
> nbd_open // conf_ref=3
> recv_work A done // conf_ref=2
> NBD_CLEAR_SOCK // conf_ref=1
> nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)
> close nbd // conf_ref=1
> recv_work B
> config_put // conf_ref=0
> atomic_dec(&config->recv_threads); -> UAF
>
> [...]
Applied, thanks!
[1/1] nbd: defer config put in recv_work
commit: 9517b82d8d422d426a988b213fdd45c6b417b86d
Best regards,
--
Jens Axboe
Reply to: