Re: [Devel] [PATCH rh7 v2] tcache: fix use-after-free in tcache_invalidate_node_pages()

2015-12-09 Thread Andrey Ryabinin
On 12/09/2015 12:55 PM, Vladimir Davydov wrote: >> +/* >> + * Restart iteration over the radix tree, because the >> + * current node could have been freed when we dropped >> + * the lock. >> + */ >

Re: [Devel] [PATCH rh7 v2] tcache: fix use-after-free in tcache_invalidate_node_pages()

2015-12-09 Thread Vladimir Davydov
On Wed, Dec 09, 2015 at 12:44:34PM +0300, Andrey Ryabinin wrote: > tcache_invalidate_node_pages() temporarly drops/takes back node->tree_lock. > Once lock was dropped, we can't continue iterating to the next slot, because > another thread might remove and free it. If lock was dropped tree iteration

[Devel] [PATCH rh7 v2] tcache: fix use-after-free in tcache_invalidate_node_pages()

2015-12-09 Thread Andrey Ryabinin
tcache_invalidate_node_pages() temporarly drops/takes back node->tree_lock. Once lock was dropped, we can't continue iterating to the next slot, because another thread might remove and free it. If lock was dropped tree iteration has to be restarted. Wit this patch we also drop the lock iff we need