diff options
| author | Chris Mason <mason@kernel.org> | 2026-10-28 10:41:42 -0600 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-10-29 07:23:20 -0600 |
| commit | 4912dab88baa5f7034dc9e38807804d470ae5438 (patch) | |
| tree | 23c85a1bf063e311c660ee7d1f931b0cdeed4ee1 /tools/lib/python | |
| parent | 81941915d53ef3384ab4e4b68e92673e66cf66d7 (diff) | |
rnbd-srv: fix use-after-free on two CLOSE messages
process_msg_close() looks the sess_dev up with a kref, drops it right
away, and only then takes the session mutex for the teardown. A session
has several connections handled by different workers, so two CLOSE
messages for the same ID both finish the lookup before either one tears
the sess_dev down, and the second one works on freed memory. Any host
that can open a device on the server can do that.
Take the mutex first and look the ID up with xa_load() under it. The
second CLOSE then finds nothing.
Fixes: 2de6c8de192b ("block/rnbd: server: main functionality")
Cc: "Md. Haris Iqbal" <haris.iqbal@ionos.com>
Cc: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Chris Mason <mason@kernel.org>
Link: https://patch.msgid.link/20261028164415.1262013-40-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions