DF-4466 / fix.diff
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 | --- a/sys/dev/disk/dm/crypt/dm_target_crypt.c +++ b/sys/dev/disk/dm/crypt/dm_target_crypt.c @@ -96,8 +96,19 @@ struct malloc_pipe read_mpipe; struct malloc_pipe write_mpipe; + /* + * In-flight bios that still reference this config (see + * dm_target_crypt_destroy). + */ + volatile int nactive; + } dm_target_crypt_config_t; +#define DMTC_BIO_DONE(priv) do { \ + if (atomic_fetchadd_int(&(priv)->nactive, -1) == 1) \ + wakeup(priv); \ +} while (0) + struct dmtc_dump_helper { dm_target_crypt_config_t *priv; void *data; @@ -488,6 +499,9 @@ priv = kmalloc(sizeof(dm_target_crypt_config_t), M_DMCRYPT, M_WAITOK); + /* No in-flight bios reference this config yet */ + priv->nactive = 0; + /* Insert dmp to global pdev list */ if ((priv->pdev = dm_pdev_insert(dev)) == NULL) { kprintf("dm_target_crypt: dm_pdev_insert failed\n"); @@ -617,6 +631,16 @@ return 0; dm_pdev_decr(priv->pdev); + /* + * Wait until every in-flight bio referencing this config has + * completed. dmstrategy drops its table reference as soon as + * strategy() returns, but crypt completions run asynchronously + * afterwards holding nothing but bio_caller_info1.ptr; freeing + * the config (and the mpipes) underneath them is a use-after-free. + */ + while (priv->nactive != 0) + tsleep(priv, 0, "dmtcdn", 1); + dmtc_destroy_mpipe(priv); /* @@ -692,6 +716,7 @@ switch (bp->b_cmd) { case BUF_CMD_READ: + atomic_add_int(&priv->nactive, 1); bio = push_bio(&bp->b_bio1); bio->bio_offset = bp->b_bio1.bio_offset + priv->block_offset * DEV_BSIZE; @@ -700,6 +725,7 @@ vn_strategy(priv->pdev->pdev_vnode, bio); break; case BUF_CMD_WRITE: + atomic_add_int(&priv->nactive, 1); bio = push_bio(&bp->b_bio1); bio->bio_offset = bp->b_bio1.bio_offset + priv->block_offset * DEV_BSIZE; @@ -729,6 +755,7 @@ dmtc_bio_read_done(struct bio *bio) { struct bio *obio; + dm_target_crypt_config_t *priv = bio->bio_caller_info1.ptr; /* * If a read error occurs we shortcut the operation, otherwise @@ -737,6 +764,7 @@ if (bio->bio_buf->b_flags & B_ERROR) { obio = pop_bio(bio); biodone(obio); + DMTC_BIO_DONE(priv); } else { dmtc_bio_read_decrypt_start(bio); } @@ -829,6 +857,8 @@ if (mpipe) mpipe_free(mpipe, data_buf); + + DMTC_BIO_DONE(priv); } /************************************************************************ @@ -906,6 +936,8 @@ bio->bio_buf->b_flags |= B_ERROR; struct bio *obio = pop_bio(bio); biodone(obio); + + DMTC_BIO_DONE(priv); } else { bio->bio_caller_info2.ptr = bio->bio_buf->b_data; /* orig_buf */ bio->bio_buf->b_data = data_buf; @@ -946,6 +978,8 @@ struct bio *obio = pop_bio(bio); biodone(obio); + + DMTC_BIO_DONE(priv); } /************************************************************************ |