Re: [PATCH 5.12] io_uring: Convert personality_idr to XArray

[Jens Axboe <axboe@kernel.dk>]

On 3/13/21 1:02 AM, yangerkun wrote:
> 
> 
> 在 2021/3/9 19:23, yangerkun 写道:
>>
>>
>> 在 2021/3/8 22:22, Pavel Begunkov 写道:
>>> On 08/03/2021 14:16, Pavel Begunkov wrote:
>>>> From: "Matthew Wilcox (Oracle)" <willy@infradead.org>
>>>>
>>>> You can't call idr_remove() from within a idr_for_each() callback,
>>>> but you can call xa_erase() from an xa_for_each() loop, so switch the
>>>> entire personality_idr from the IDR to the XArray.  This manifests as a
>>>> use-after-free as idr_for_each() attempts to walk the rest of the node
>>>> after removing the last entry from it.
>>>
>>> yangerkun, can you test it and similarly take care of buffer idr?
>>
>> Will try it latter :)
> 
> Sorry for the latter reply. The patch pass the testcase.
> 
> Besides, should we apply this patch first to deal with the same UAF for
> io_buffer_idr before convert to XArray?
> 
> https://lore.kernel.org/io-uring/20210308065903.2228332-2-yangerkun@huawei.com/T/#u

Agree, and then defer an xarray conversion to 5.13. I'll take a look at
your patch and get it applied.

-- 
Jens Axboe