Re: [PATCH -nect RFC v2 0/2] block: fix uaf in bd_link_disk_holder()

[Christoph Hellwig]

On Fri, Oct 21, 2022 at 11:15:34AM +0800, Yu Kuai wrote:
> Hi,
>
> 在 2022/10/21 0:47, Christoph Hellwig 写道:
>> As mentioned before I don't think we should make this even more
>> crufty in the block layer.  See the series I just sent to move it int
>> dm.
>
> It seems we had some misunderstanding, the problem I tried to fix here
> should not just related to dm, but all the caller of
> bd_link_disk_holder().

As far as I can tell the problem was just that patch 1 in my series blows
away the bd_holder_dir pointer in part0 on del_gendisk.  Each holder
actually holds a reference to the kobject, so the memory for it is
still valid, it's just that the pointer got cleared.  I'll send a v2
in a bit.