NoaSoftware
/
TencentOS-kernel
forked from TencentOS/TencentOS-kernel
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
TencentOS-kernel/drivers
History
Pavel Skripkin 7fe272d973 block: nbd: add sanity check for first_minor 
[ Upstream commit b1a811633f7321cf1ae2bb76a66805b7720e44c9 ]

Syzbot hit WARNING in internal_create_group(). The problem was in
too big disk->first_minor.

disk->first_minor is initialized by value, which comes from userspace
and there wasn't any sanity checks about value correctness. It can cause
duplicate creation of sysfs files/links, because disk->first_minor will
be passed to MKDEV() which causes truncation to byte. Since maximum
minor value is 0xff, let's check if first_minor is correct minor number.

NOTE: the root case of the reported warning was in wrong error handling
in register_disk(), but we can avoid passing knowingly wrong values to
sysfs API, because sysfs error messages can confuse users. For example:
user passed 1048576 as index, but sysfs complains about duplicate
creation of /dev/block/43:0. It's not obvious how 1048576 becomes 0.
Log and reproducer for above example can be found on syzkaller bug
report page.

Link: https://syzkaller.appspot.com/bug?id=03c2ae9146416edf811958d5fd7acfab75b143d1
Fixes: b0d9111a2d53 ("nbd: use an idr to keep track of nbd devices")
Reported-by: syzbot+9937dc42271cd87d4b98@syzkaller.appspotmail.com
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2022-11-14 19:08:34 +08:00
..
accessibility
…
acpi ACPICA: Utilities: Avoid deleting the same object twice in a row 2022-10-14 12:08:48 +08:00
amba amba: Fix resource leak for drivers without .remove 2021-04-12 12:52:26 +08:00
android binder: add flag to clear buffer on txn complete 2021-03-16 16:43:28 +08:00
ata ata: libahci_platform: fix IRQ check 2021-05-20 16:07:53 +08:00
atm atm: idt77252: fix null-ptr-dereference 2021-04-12 12:53:23 +08:00
auxdisplay auxdisplay: ht16k33: Fix refresh rate handling 2021-04-12 12:52:25 +08:00
base Add sysfs attribute to hide disk devices 2022-07-25 16:24:47 +08:00
bcma
…
block block: nbd: add sanity check for first_minor 2022-11-14 19:08:34 +08:00
bluetooth Bluetooth: hci_h5: Set HCI_QUIRK_SIMULTANEOUS_DISCOVERY for btrtl 2021-04-12 12:52:46 +08:00
bus bus: qcom: Put child node before return 2021-05-20 16:07:47 +08:00
cdrom
…
char ttyprintk: Add TTY hangup callback. 2021-05-20 16:07:51 +08:00
clk clk: uniphier: Fix potential infinite loop 2021-05-20 16:07:53 +08:00
clocksource clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined 2021-04-12 12:52:24 +08:00
connector
…
counter counter: stm32-timer-cnt: fix ceiling miss-alignment with reload register 2021-05-20 16:06:54 +08:00
cpufreq cpufreq: armada-37xx: Fix determining base CPU frequency 2021-05-20 16:07:50 +08:00
cpuidle Intel: cpuidle: Allow idle states to be disabled by default 2021-04-25 14:31:12 +08:00
crypto crypto: qat - Fix a double free in adf_create_ring 2021-05-20 16:07:49 +08:00
dax device-dax/core: Fix memory leak when rmmod dax.ko 2021-03-16 16:43:45 +08:00
dca
…
devfreq PM / devfreq: Use more accurate returned new_freq as resume_freq 2021-05-20 16:07:49 +08:00
dio
…
dma dmaengine: dw: Make it dependent to HAS_IOMEM 2021-05-20 16:07:08 +08:00
dma-buf dmabuf: fix use-after-free of dmabuf's file->f_inode 2021-04-12 12:51:14 +08:00
edac EDAC/amd64: Drop some family checks for newer systems 2021-09-23 19:21:36 +08:00
eisa
…
extcon extcon: arizona: Fix various races on driver unbind 2021-05-20 16:07:27 +08:00
firewire firewire: nosy: Fix a use-after-free bug in nosy_ioctl() 2021-05-20 16:06:50 +08:00
firmware firmware: qcom-scm: Fix QCOM_SCM configuration 2021-05-20 16:07:51 +08:00
fpga
…
fsi
…
gnss
…
gpio gpio: omap: Save and restore sysconfig 2021-05-20 16:07:14 +08:00
gpu drm/hisilicon: Features to support reading resolutions from EDID 2022-10-17 19:09:10 +08:00
greybus
…
hid HID: plantronics: Workaround for double volume key presses 2021-05-20 16:07:55 +08:00
hsi HSI: core: fix resource leaks in hsi_add_client_from_dt() 2021-05-20 16:07:54 +08:00
hv Drivers: hv: vmbus: Increase wait time for VMbus unload 2021-05-20 16:07:51 +08:00
hwmon hwmon: (pwm-fan) Ensure that calculation doesn't discard big period values 2021-04-12 12:51:24 +08:00
hwspinlock
…
hwtracing intel_th: pci: Add Alder Lake-M support 2021-05-20 16:07:34 +08:00
i2c ampere/i2c: designware: Issue abort if the bus got stuck during a transfer 2021-07-12 08:57:22 +00:00
i3c Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" 2021-05-20 16:07:44 +08:00
ide scsi: ide: Do not set the RQF_PREEMPT flag for sense requests 2021-04-12 12:51:06 +08:00
idle Intel: intel_idle: Customize IceLake server support 2021-04-25 14:31:16 +08:00
iio iio:accel:adis16201: Fix wrong axis assignment that prevents loading 2021-05-20 16:07:40 +08:00
infiniband RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res 2021-05-20 16:08:01 +08:00
input Input: ili210x - add missing negation for touch indication on ili210x 2021-05-20 16:07:34 +08:00
interconnect interconnect: core: fix error return code of icc_link_destroy() 2021-05-20 16:07:05 +08:00
iommu iommu/phytium: fix PLX acs bug on phytium platform 2022-09-23 12:39:52 +08:00
ipack
…
irqchip iommu/phytium: fix PLX acs bug on phytium platform 2022-09-23 12:39:52 +08:00
isdn mISDN: fix crash in fritzpci 2021-05-20 16:06:52 +08:00
leds ampere/led: Add Altra LED driver 2021-07-12 08:57:22 +00:00
lightnvm lightnvm: fix memory leak when submit fails 2021-04-12 12:51:39 +08:00
macintosh
…
mailbox mailbox: avoid timer start from callback 2021-03-16 16:38:59 +08:00
mcb
…
md md: Fix missing unused status line of /proc/mdstat 2021-05-20 16:07:41 +08:00
media bpf: Implement CAP_BPF 2022-08-30 11:33:26 +08:00
memory memory: pl353: fix mask of ECC page_size config register 2021-05-20 16:07:48 +08:00
memstick memstick: r592: Fix error return in r592_probe() 2021-03-16 16:43:02 +08:00
message scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() 2021-03-16 16:39:58 +08:00
mfd mfd: stm32-timers: Avoid clearing auto reload register 2021-05-20 16:07:54 +08:00
misc misc: vmw_vmci: explicitly initialize vmci_datagram payload 2021-05-20 16:07:40 +08:00
mmc mmc: sdhci-pci: Add PCI IDs for Intel LKF 2021-05-20 16:07:28 +08:00
mtd mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init 2021-05-20 16:07:48 +08:00
mux
…
net virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO 2022-10-18 10:47:43 +08:00
nfc nfc: pn533: prevent potential memory corruption 2021-05-20 16:07:56 +08:00
ntb NTB: hw: amd: fix an issue about leak system resources 2021-03-16 16:39:10 +08:00
nubus
…
nvdimm libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC 2021-05-20 16:07:11 +08:00
nvme nvme-pci: initialize tagset numa value to the value of the ctrl 2021-08-18 07:22:38 +00:00
nvmem nvmem: core: skip child nodes not matching binding 2021-04-12 12:52:30 +08:00
of Revert "fdt: Properly handle "no-map" field in the memory region" 2021-05-20 16:08:02 +08:00
opp opp: Reduce the size of critical section in _opp_table_kref_release() 2021-03-16 16:40:41 +08:00
oprofile
…
parisc
…
parport
…
pci iommu/phytium: fix PLX acs bug on phytium platform 2022-09-23 12:39:52 +08:00
pcmcia
…
perf perf/arm_pmu_platform: Fix error handling 2021-05-20 16:07:24 +08:00
phy phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally 2021-05-20 16:07:47 +08:00
pinctrl pinctrl: lewisburg: Update number of pins in community 2021-05-20 16:07:14 +08:00
platform platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table 2021-05-20 16:07:51 +08:00
pnp
…
power power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() 2021-05-20 16:07:29 +08:00
powercap powercap: restrict energy meter to root access 2021-03-16 16:40:32 +08:00
pps
…
ps3 powerpc/ps3: use dma_mapping_error() 2021-03-16 16:43:15 +08:00
ptp
…
pwm pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare() 2021-04-12 12:52:30 +08:00
rapidio rapidio: fix the missed put_device() for rio_mport_add_riodev 2021-03-16 16:38:59 +08:00
ras Intel: x86/mce: Fix all mce notifiers to update the mce->kflags bitmask 2021-04-25 14:31:15 +08:00
regulator regulator: bd9571mwv: Fix AVS and DVFS voltage range 2021-05-20 16:06:58 +08:00
remoteproc remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio() 2021-03-16 16:43:11 +08:00
reset
…
rpmsg rpmsg: glink: Use complete_all for open states 2021-03-16 16:39:50 +08:00
rtc rtc: s5m: select REGMAP_I2C 2021-04-12 12:52:24 +08:00
s390 s390/dasd: fix hanging IO request during DASD driver unbind 2021-04-12 12:53:06 +08:00
sbus
…
scsi Update LPFC driver from 12.4 to 12.8 2022-03-02 10:48:07 +08:00
sfi
…
sh
…
siox
…
slimbus slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI 2021-03-16 16:42:54 +08:00
soc soc: aspeed: fix a ternary sign expansion bug 2021-05-20 16:07:52 +08:00
soundwire soundwire: stream: fix memory leak in stream config error path 2021-05-20 16:07:48 +08:00
spi spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware() 2021-05-20 16:07:50 +08:00
spmi spmi: spmi-pmic-arb: Fix hw_irq overflow 2021-04-12 12:52:39 +08:00
ssb
…
staging media: omap4iss: return error code when omap4iss_get() failed 2021-05-20 16:07:52 +08:00
target scsi: target: pscsi: Fix warning in pscsi_complete_cmd() 2021-05-20 16:07:27 +08:00
tc
…
tee tee: optee: do not check memref size on return from Secure World 2021-05-20 16:07:24 +08:00
thermal thermal/core: Add NULL pointer check before using cooling device stats 2021-05-20 16:06:47 +08:00
thunderbolt thunderbolt: Fix use-after-free in remove_unplugged_switch() 2021-03-16 16:42:03 +08:00
tty serial: core: return early on unsupported ioctls 2021-05-20 16:07:50 +08:00
uio uio: avoid to request_irq when the legacy irq is not connected 2021-03-16 16:43:58 +08:00
usb kabi: disable USB_STORAGE module namespace 2021-06-23 07:24:18 +00:00
vfio vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer 2021-05-20 16:07:53 +08:00
vhost vhost: Fix vhost_vq_reset() 2021-05-20 16:06:46 +08:00
video fbdev: zero-fill colormap in fbcmap.c 2021-05-20 16:07:23 +08:00
virt virt: vbox: Do not use wait_event_interruptible when called from kernel context 2021-04-12 12:52:10 +08:00
virtio virtio_ring: Fix two use after free bugs 2021-03-16 16:43:19 +08:00
visorbus
…
vlynq
…
vme
…
w1 w1: mxc_w1: Fix timeout resolution problem leading to bus error 2021-03-16 16:39:58 +08:00
watchdog watchdog: mei_wdt: request stop on unregister 2021-04-12 12:52:38 +08:00
xen xen/events: fix setting irq affinity 2021-05-20 16:07:06 +08:00
zorro
…
Kconfig
…
Makefile
…