]> git.proxmox.com Git - mirror_spl.git/commit
Fix use-after-free in taskq_seq_show_impl
authorChunwei Chen <tuxoko@gmail.com>
Fri, 4 Aug 2017 16:57:58 +0000 (09:57 -0700)
committerBrian Behlendorf <behlendorf1@llnl.gov>
Fri, 4 Aug 2017 16:57:58 +0000 (09:57 -0700)
commitcce83ba0ecacc45c79709e8b3def8dc8a046fffe
treef788aac7984b256b38d0d7a3a2fb1b25d4bc1f6c
parent6ecfd2b55333dbaf8755bcab53ae9d37b6bca7c1
Fix use-after-free in taskq_seq_show_impl

taskq_seq_show_impl walks the tq_active_list to show the tqent_func and
tqent_arg. However for taskq_dispatch_ent, it's very likely that the
task entry will be freed during the function call, and causes a
use-after-free bug.

To fix this, we duplicate the task entry to an on-stack struct, and
assign it instead to tqt_task. This way, the tq_lock alone will
guarantee its safety.

Reviewed-by: Tim Chase <tim@chase2k.com>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Chunwei Chen <david.chen@osnexus.com>
Closes #638
Closes #640
module/spl/spl-taskq.c