Go to file
Pavel Skripkin 7fe272d973 block: nbd: add sanity check for first_minor
[ Upstream commit b1a811633f7321cf1ae2bb76a66805b7720e44c9 ]

Syzbot hit WARNING in internal_create_group(). The problem was in
too big disk->first_minor.

disk->first_minor is initialized by value, which comes from userspace
and there wasn't any sanity checks about value correctness. It can cause
duplicate creation of sysfs files/links, because disk->first_minor will
be passed to MKDEV() which causes truncation to byte. Since maximum
minor value is 0xff, let's check if first_minor is correct minor number.

NOTE: the root case of the reported warning was in wrong error handling
in register_disk(), but we can avoid passing knowingly wrong values to
sysfs API, because sysfs error messages can confuse users. For example:
user passed 1048576 as index, but sysfs complains about duplicate
creation of /dev/block/43:0. It's not obvious how 1048576 becomes 0.
Log and reproducer for above example can be found on syzkaller bug
report page.

Link: https://syzkaller.appspot.com/bug?id=03c2ae9146416edf811958d5fd7acfab75b143d1
Fixes: b0d9111a2d53 ("nbd: use an idr to keep track of nbd devices")
Reported-by: syzbot+9937dc42271cd87d4b98@syzkaller.appspotmail.com
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-11-14 19:08:34 +08:00
Documentation docs/bpf: Add BPF ring buffer design notes 2022-08-30 11:33:29 +08:00
LICENSES Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
arch dist: tk4: fix debugedit compact issue 2022-10-17 17:31:28 +08:00
block Add sysfs attribute to hide disk devices 2022-07-25 16:24:47 +08:00
certs certs: Fix blacklist flag type confusion 2021-04-12 12:52:25 +08:00
crypto crypto: rng - fix crypto_rng_reset() refcounting when !CRYPTO_STATS 2021-05-20 16:07:34 +08:00
dist dist: fix remote name in check-commits 2022-10-18 11:37:20 +08:00
drivers block: nbd: add sanity check for first_minor 2022-11-14 19:08:34 +08:00
fs bpf: Refactor to provide aux info to bpf_iter_init_seq_priv_t 2022-08-30 11:33:28 +08:00
include raw: convert raw sockets to RCU 2022-11-03 14:14:19 +08:00
init bpf: Introduce BPF_PROG_TYPE_LSM 2022-08-30 11:33:21 +08:00
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index 2021-03-16 16:27:51 +08:00
kernel sli: fix the compiling error caused by memory access out of range 2022-10-14 16:20:22 +08:00
lib bug: Remove redundant condition check in report_bug 2021-05-20 16:07:55 +08:00
mm Revert "mm/lru: introduce TestClearPageLRU" 2022-09-05 20:56:40 +08:00
net raw: convert raw sockets to RCU 2022-11-03 14:14:19 +08:00
package configs: set EDD, RAID, CRAMFS as modules 2022-10-25 15:15:58 +08:00
samples kfifo: fix ternary sign extension bugs 2021-05-20 16:08:01 +08:00
scripts bpf: fix selftest case compile error for bpf_timer 2022-08-30 11:33:34 +08:00
security bpf: Implement bpf_local_storage for inodes 2022-08-30 11:33:29 +08:00
sound ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails 2021-05-20 16:07:59 +08:00
tools bpf, selftests: Add redirect_peer selftest 2022-08-30 11:33:35 +08:00
usr Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
virt KVM: Stop looking for coalesced MMIO zones if the bus is destroyed 2021-05-20 16:07:44 +08:00
.clang-format Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.cocciconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.get_maintainer.ignore Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.gitattributes dist: hook into kernel build system 2022-10-17 02:25:35 +08:00
.gitignore dist: hook into kernel build system 2022-10-17 02:25:35 +08:00
COPYING Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
CREDITS Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Kbuild Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
MAINTAINERS bpf: Introduce BPF_PROG_TYPE_LSM 2022-08-30 11:33:21 +08:00
Makefile dist: hook into kernel build system 2022-10-17 02:25:35 +08:00
README Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
README.md Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
backport_remove_lists.txt Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tools_key.pub Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00

README.md

Tencent Linux Kernel 4.0