lkml.org 
[lkml]   [2020]   [Apr]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 013/146] null_blk: Fix the null_add_dev() error path
    Date
    From: Bart Van Assche <bvanassche@acm.org>

    [ Upstream commit 2004bfdef945fe55196db6b9cdf321fbc75bb0de ]

    If null_add_dev() fails, clear dev->nullb.

    This patch fixes the following KASAN complaint:

    BUG: KASAN: use-after-free in nullb_device_submit_queues_store+0xcf/0x160 [null_blk]
    Read of size 8 at addr ffff88803280fc30 by task check/8409

    Call Trace:
    dump_stack+0xa5/0xe6
    print_address_description.constprop.0+0x26/0x260
    __kasan_report.cold+0x7b/0x99
    kasan_report+0x16/0x20
    __asan_load8+0x58/0x90
    nullb_device_submit_queues_store+0xcf/0x160 [null_blk]
    configfs_write_file+0x1c4/0x250 [configfs]
    __vfs_write+0x4c/0x90
    vfs_write+0x145/0x2c0
    ksys_write+0xd7/0x180
    __x64_sys_write+0x47/0x50
    do_syscall_64+0x6f/0x2f0
    entry_SYSCALL_64_after_hwframe+0x49/0xbe
    RIP: 0033:0x7ff370926317
    Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
    RSP: 002b:00007fff2dd2da48 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
    RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007ff370926317
    RDX: 0000000000000002 RSI: 0000559437ef23f0 RDI: 0000000000000001
    RBP: 0000559437ef23f0 R08: 000000000000000a R09: 0000000000000001
    R10: 0000559436703471 R11: 0000000000000246 R12: 0000000000000002
    R13: 00007ff370a006a0 R14: 00007ff370a014a0 R15: 00007ff370a008a0

    Allocated by task 8409:
    save_stack+0x23/0x90
    __kasan_kmalloc.constprop.0+0xcf/0xe0
    kasan_kmalloc+0xd/0x10
    kmem_cache_alloc_node_trace+0x129/0x4c0
    null_add_dev+0x24a/0xe90 [null_blk]
    nullb_device_power_store+0x1b6/0x270 [null_blk]
    configfs_write_file+0x1c4/0x250 [configfs]
    __vfs_write+0x4c/0x90
    vfs_write+0x145/0x2c0
    ksys_write+0xd7/0x180
    __x64_sys_write+0x47/0x50
    do_syscall_64+0x6f/0x2f0
    entry_SYSCALL_64_after_hwframe+0x49/0xbe

    Freed by task 8409:
    save_stack+0x23/0x90
    __kasan_slab_free+0x112/0x160
    kasan_slab_free+0x12/0x20
    kfree+0xdf/0x250
    null_add_dev+0xaf3/0xe90 [null_blk]
    nullb_device_power_store+0x1b6/0x270 [null_blk]
    configfs_write_file+0x1c4/0x250 [configfs]
    __vfs_write+0x4c/0x90
    vfs_write+0x145/0x2c0
    ksys_write+0xd7/0x180
    __x64_sys_write+0x47/0x50
    do_syscall_64+0x6f/0x2f0
    entry_SYSCALL_64_after_hwframe+0x49/0xbe

    Fixes: 2984c8684f96 ("nullb: factor disk parameters")
    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
    Cc: Johannes Thumshirn <jth@kernel.org>
    Cc: Hannes Reinecke <hare@suse.com>
    Cc: Ming Lei <ming.lei@redhat.com>
    Cc: Christoph Hellwig <hch@infradead.org>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/block/null_blk_main.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
    index c5c0b7c894815..002072429290e 100644
    --- a/drivers/block/null_blk_main.c
    +++ b/drivers/block/null_blk_main.c
    @@ -1844,6 +1844,7 @@ out_cleanup_queues:
    cleanup_queues(nullb);
    out_free_nullb:
    kfree(nullb);
    + dev->nullb = NULL;
    out:
    return rv;
    }
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-04-16 18:03    [W:4.482 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site