TencentOS
/
TencentOS-kernel
mirror of https://github.com/Tencent/TencentOS-kernel
0
0
Fork 4
Code Issues Projects Releases Wiki Activity
TencentOS-kernel/drivers
History
Josef Bacik 37aaa319a6 nbd: handle device refs for DESTROY_ON_DISCONNECT properly 
commit c9a2f90f4d6b9d42b9912f7aaf68e8d748acfffd upstream.

There exists a race where we can be attempting to create a new nbd
configuration while a previous configuration is going down, both
configured with DESTROY_ON_DISCONNECT.  Normally devices all have a
reference of 1, as they won't be cleaned up until the module is torn
down.  However with DESTROY_ON_DISCONNECT we'll make sure that there is
only 1 reference (generally) on the device for the config itself, and
then once the config is dropped, the device is torn down.

The race that exists looks like this

TASK1					TASK2
nbd_genl_connect()
  idr_find()
    refcount_inc_not_zero(nbd)
      * count is 2 here ^^
					nbd_config_put()
					  nbd_put(nbd) (count is 1)
    setup new config
      check DESTROY_ON_DISCONNECT
	put_dev = true
    if (put_dev) nbd_put(nbd)
	* free'd here ^^

In nbd_genl_connect() we assume that the nbd ref count will be 2,
however clearly that won't be true if the nbd device had been setup as
DESTROY_ON_DISCONNECT with its prior configuration.  Fix this by getting
rid of the runtime flag to check if we need to mess with the nbd device
refcount, and use the device NBD_DESTROY_ON_DISCONNECT flag to check if
we need to adjust the ref counts.  This was reported by syzkaller with
the following kasan dump

BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:71 [inline]
BUG: KASAN: use-after-free in atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
BUG: KASAN: use-after-free in refcount_dec_not_one+0x71/0x1e0 lib/refcount.c:76
Read of size 4 at addr ffff888143bf71a0 by task systemd-udevd/8451

CPU: 0 PID: 8451 Comm: systemd-udevd Not tainted 5.11.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:230
 __kasan_report mm/kasan/report.c:396 [inline]
 kasan_report.cold+0x79/0xd5 mm/kasan/report.c:413
 check_memory_region_inline mm/kasan/generic.c:179 [inline]
 check_memory_region+0x13d/0x180 mm/kasan/generic.c:185
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
 refcount_dec_not_one+0x71/0x1e0 lib/refcount.c:76
 refcount_dec_and_mutex_lock+0x19/0x140 lib/refcount.c:115
 nbd_put drivers/block/nbd.c:248 [inline]
 nbd_release+0x116/0x190 drivers/block/nbd.c:1508
 __blkdev_put+0x548/0x800 fs/block_dev.c:1579
 blkdev_put+0x92/0x570 fs/block_dev.c:1632
 blkdev_close+0x8c/0xb0 fs/block_dev.c:1640
 __fput+0x283/0x920 fs/file_table.c:280
 task_work_run+0xdd/0x190 kernel/task_work.c:140
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:174 [inline]
 exit_to_user_mode_prepare+0x249/0x250 kernel/entry/common.c:201
 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
 syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fc1e92b5270
Code: 73 01 c3 48 8b 0d 38 7d 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 59 c1 20 00 00 75 10 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ee fb ff ff 48 89 04 24
RSP: 002b:00007ffe8beb2d18 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000007 RCX: 00007fc1e92b5270
RDX: 000000000aba9500 RSI: 0000000000000000 RDI: 0000000000000007
RBP: 00007fc1ea16f710 R08: 000000000000004a R09: 0000000000000008
R10: 0000562f8cb0b2a8 R11: 0000000000000246 R12: 0000000000000000
R13: 0000562f8cb0afd0 R14: 0000000000000003 R15: 000000000000000e

Allocated by task 1:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:401 [inline]
 ____kasan_kmalloc.constprop.0+0x82/0xa0 mm/kasan/common.c:429
 kmalloc include/linux/slab.h:552 [inline]
 kzalloc include/linux/slab.h:682 [inline]
 nbd_dev_add+0x44/0x8e0 drivers/block/nbd.c:1673
 nbd_init+0x250/0x271 drivers/block/nbd.c:2394
 do_one_initcall+0x103/0x650 init/main.c:1223
 do_initcall_level init/main.c:1296 [inline]
 do_initcalls init/main.c:1312 [inline]
 do_basic_setup init/main.c:1332 [inline]
 kernel_init_freeable+0x605/0x689 init/main.c:1533
 kernel_init+0xd/0x1b8 init/main.c:1421
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

Freed by task 8451:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:356
 ____kasan_slab_free+0xe1/0x110 mm/kasan/common.c:362
 kasan_slab_free include/linux/kasan.h:192 [inline]
 slab_free_hook mm/slub.c:1547 [inline]
 slab_free_freelist_hook+0x5d/0x150 mm/slub.c:1580
 slab_free mm/slub.c:3143 [inline]
 kfree+0xdb/0x3b0 mm/slub.c:4139
 nbd_dev_remove drivers/block/nbd.c:243 [inline]
 nbd_put.part.0+0x180/0x1d0 drivers/block/nbd.c:251
 nbd_put drivers/block/nbd.c:295 [inline]
 nbd_config_put+0x6dd/0x8c0 drivers/block/nbd.c:1242
 nbd_release+0x103/0x190 drivers/block/nbd.c:1507
 __blkdev_put+0x548/0x800 fs/block_dev.c:1579
 blkdev_put+0x92/0x570 fs/block_dev.c:1632
 blkdev_close+0x8c/0xb0 fs/block_dev.c:1640
 __fput+0x283/0x920 fs/file_table.c:280
 task_work_run+0xdd/0x190 kernel/task_work.c:140
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:174 [inline]
 exit_to_user_mode_prepare+0x249/0x250 kernel/entry/common.c:201
 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
 syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff888143bf7000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 416 bytes inside of
 1024-byte region [ffff888143bf7000, ffff888143bf7400)
The buggy address belongs to the page:
page:000000005238f4ce refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x143bf0
head:000000005238f4ce order:3 compound_mapcount:0 compound_pincount:0
flags: 0x57ff00000010200(slab|head)
raw: 057ff00000010200 ffffea00004b1400 0000000300000003 ffff888010c41140
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888143bf7080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888143bf7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888143bf7180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                               ^
 ffff888143bf7200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

Reported-and-tested-by: syzbot+429d3f82d757c211bff3@syzkaller.appspotmail.com
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2021-04-12 12:52:44 +08:00
..
accessibility
…
acpi ACPI: configfs: add missing check after configfs_register_default_group() 2021-04-12 12:52:32 +08:00
amba amba: Fix resource leak for drivers without .remove 2021-04-12 12:52:26 +08:00
android binder: add flag to clear buffer on txn complete 2021-03-16 16:43:28 +08:00
ata ata: ahci_brcm: Add back regulators management 2021-04-12 12:52:20 +08:00
atm atm: idt77252: call pci_disable_device() on error path 2021-04-12 12:51:07 +08:00
auxdisplay auxdisplay: ht16k33: Fix refresh rate handling 2021-04-12 12:52:25 +08:00
base regmap: sdw: use _no_pm functions in regmap_read/write 2021-04-12 12:52:31 +08:00
bcma
…
block nbd: handle device refs for DESTROY_ON_DISCONNECT properly 2021-04-12 12:52:44 +08:00
bluetooth Bluetooth: btusb: Fix memory leak in btusb_mtk_wmt_recv 2021-04-12 12:52:14 +08:00
bus bus: fsl-mc: fix error return code in fsl_mc_object_allocate() 2021-03-16 16:43:09 +08:00
cdrom
…
char tpm_tis: Clean up locality release 2021-04-12 12:52:35 +08:00
clk clk: aspeed: Fix APLL calculate formula from ast2600-A2 2021-04-12 12:52:28 +08:00
clocksource clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined 2021-04-12 12:52:24 +08:00
connector
…
counter
…
cpufreq cpufreq: intel_pstate: Get per-CPU max freq via MSR_HWP_CAPABILITIES if available 2021-04-12 12:52:40 +08:00
cpuidle cpuidle: Fixup IRQ state 2021-03-16 16:35:25 +08:00
crypto crypto: sun4i-ss - initialize need_fallback 2021-04-12 12:52:36 +08:00
dax device-dax/core: Fix memory leak when rmmod dax.ko 2021-03-16 16:43:45 +08:00
dca
…
devfreq PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out 2021-03-16 16:36:35 +08:00
dio
…
dma dmaengine: hsu: disable spurious interrupt 2021-04-12 12:52:24 +08:00
dma-buf dmabuf: fix use-after-free of dmabuf's file->f_inode 2021-04-12 12:51:14 +08:00
edac EDAC/amd64: Fix PCI component registration 2021-03-16 16:43:29 +08:00
eisa
…
extcon extcon: max77693: Fix modalias string 2021-03-16 16:43:12 +08:00
firewire
…
firmware firmware: imx: select SOC_BUS to fix firmware build 2021-04-12 12:51:46 +08:00
fpga
…
fsi
…
gnss
…
gpio gpio: pcf857x: Fix missing first interrupt 2021-04-12 12:52:39 +08:00
gpu drm/i915: Reject 446-480MHz HDMI clock on GLK 2021-04-12 12:52:41 +08:00
greybus
…
hid HID: wacom: Ignore attempts to overwrite the touch_max value from HID 2021-04-12 12:52:32 +08:00
hsi HSI: Fix PM usage counter unbalance in ssi_hw_init 2021-04-12 12:52:22 +08:00
hv Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind() 2021-04-12 12:52:21 +08:00
hwmon hwmon: (pwm-fan) Ensure that calculation doesn't discard big period values 2021-04-12 12:51:24 +08:00
hwspinlock
…
hwtracing stm class: Fix module init return on allocation failure 2021-04-12 12:51:37 +08:00
i2c i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition 2021-04-12 12:52:32 +08:00
i3c i3c master: fix missing destroy_workqueue() on error in i3c_master_register 2021-03-16 16:43:55 +08:00
ide scsi: ide: Do not set the RQF_PREEMPT flag for sense requests 2021-04-12 12:51:06 +08:00
idle
…
iio iio: ad5504: Fix setting power-down state 2021-04-12 12:51:37 +08:00
infiniband RDMA/hns: Fixes missing error code of CMDQ 2021-04-12 12:52:29 +08:00
input Input: elantech - fix protocol errors for some trackpoints in SMBus mode 2021-04-12 12:52:43 +08:00
interconnect interconnect: qcom: qcs404: Remove GPU and display RPM IDs 2021-03-16 16:42:11 +08:00
iommu iommu/vt-d: Do not use flush-queue when caching-mode is on 2021-04-12 12:51:57 +08:00
ipack
…
irqchip irqchip/mips-cpu: Set IPI domain parent chip 2021-04-12 12:51:37 +08:00
isdn misdn: dsp: select CONFIG_BITREVERSE 2021-04-12 12:51:24 +08:00
leds leds: trigger: fix potential deadlock with libata 2021-04-12 12:51:44 +08:00
lightnvm lightnvm: fix memory leak when submit fails 2021-04-12 12:51:39 +08:00
macintosh macintosh/via-macii: Access autopoll_devs when inside lock 2021-03-16 16:33:39 +08:00
mailbox mailbox: avoid timer start from callback 2021-03-16 16:38:59 +08:00
mcb
…
md dm era: Update in-core bitset after committing the metadata 2021-04-12 12:52:42 +08:00
media media: v4l2-ctrls.c: fix shift-out-of-bounds in std_validate 2021-04-12 12:52:44 +08:00
memory memory: ti-aemif: Drop child node when jumping out loop 2021-04-12 12:52:13 +08:00
memstick memstick: r592: Fix error return in r592_probe() 2021-03-16 16:43:02 +08:00
message scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() 2021-03-16 16:39:58 +08:00
mfd mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq() 2021-04-12 12:52:27 +08:00
misc drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue 2021-04-12 12:52:36 +08:00
mmc mmc: sdhci-esdhc-imx: fix kernel panic when remove module 2021-04-12 12:52:39 +08:00
mtd mtd: spi-nor: hisi-sfc: Put child node np on error path 2021-04-12 12:52:38 +08:00
mux
…
net net: usb: qmi_wwan: support ZTE P685M modem 2021-04-12 12:52:43 +08:00
nfc nfc: s3fwrn5: Release the nfc firmware 2021-03-16 16:43:15 +08:00
ntb NTB: hw: amd: fix an issue about leak system resources 2021-03-16 16:39:10 +08:00
nubus
…
nvdimm libnvdimm/dimm: Avoid race between probe and available_slots_show() 2021-04-12 12:51:55 +08:00
nvme nvme-pci: fix error unwind in nvme_map_data 2021-04-12 12:52:43 +08:00
nvmem nvmem: core: skip child nodes not matching binding 2021-04-12 12:52:30 +08:00
of of/fdt: Make sure no-map does not remove already reserved regions 2021-04-12 12:52:24 +08:00
opp opp: Reduce the size of critical section in _opp_table_kref_release() 2021-03-16 16:40:41 +08:00
oprofile
…
parisc parisc: mask out enable and reserved bits from sba imask 2021-03-16 16:33:54 +08:00
parport
…
pci PCI: Align checking of syscall user config accessors 2021-04-12 12:52:30 +08:00
pcmcia
…
perf drivers/perf: thunderx2_pmu: Fix memory resource error handling 2021-03-16 16:38:23 +08:00
phy phy: rockchip-emmc: emmc_phy_init() always return 0 2021-04-12 12:52:29 +08:00
pinctrl pinctrl: ingenic: Fix JZ4760 support 2021-04-12 12:51:38 +08:00
platform platform/x86: hp-wmi: Disable tablet-mode reporting by default 2021-04-12 12:52:01 +08:00
pnp
…
power power: reset: at91-sama5d2_shdwc: fix wkupdbc mask 2021-04-12 12:52:24 +08:00
powercap powercap: restrict energy meter to root access 2021-03-16 16:40:32 +08:00
pps
…
ps3 powerpc/ps3: use dma_mapping_error() 2021-03-16 16:43:15 +08:00
ptp
…
pwm pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare() 2021-04-12 12:52:30 +08:00
rapidio rapidio: fix the missed put_device() for rio_mport_add_riodev 2021-03-16 16:38:59 +08:00
ras
…
regulator regulator: qcom-rpmh: fix pm8009 ldo7 2021-04-12 12:52:28 +08:00
remoteproc remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio() 2021-03-16 16:43:11 +08:00
reset
…
rpmsg rpmsg: glink: Use complete_all for open states 2021-03-16 16:39:50 +08:00
rtc rtc: s5m: select REGMAP_I2C 2021-04-12 12:52:24 +08:00
s390 virtio/s390: implement virtio-ccw revision 2 correctly 2021-04-12 12:52:40 +08:00
sbus
…
scsi scsi: bnx2fc: Fix Kconfig warning & CNIC build errors 2021-04-12 12:52:32 +08:00
sfi
…
sh
…
siox
…
slimbus slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI 2021-03-16 16:42:54 +08:00
soc soc: aspeed: snoop: Add clock control logic 2021-04-12 12:52:15 +08:00
soundwire soundwire: cadence: fix ACK/NAK handling 2021-04-12 12:52:29 +08:00
spi spi: spi-synquacer: fix set_cs handling 2021-04-12 12:52:40 +08:00
spmi spmi: spmi-pmic-arb: Fix hw_irq overflow 2021-04-12 12:52:39 +08:00
ssb
…
staging staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table 2021-04-12 12:52:37 +08:00
target cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in cxgb4 and ulds 2021-04-12 12:52:16 +08:00
tc
…
tee tee: optee: replace might_sleep with cond_resched 2021-04-12 12:51:45 +08:00
thermal thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed 2021-03-16 16:43:48 +08:00
thunderbolt thunderbolt: Fix use-after-free in remove_unplugged_switch() 2021-03-16 16:42:03 +08:00
tty serial: mvebu-uart: fix tx lost characters at power off 2021-04-12 12:51:37 +08:00
uio uio: avoid to request_irq when the legacy irq is not connected 2021-03-16 16:43:58 +08:00
usb USB: serial: mos7720: fix error code in mos7720_write() 2021-04-12 12:52:33 +08:00
vfio vfio/type1: Use follow_pte() 2021-04-12 12:52:31 +08:00
vhost vhost_net: fix ubuf refcount incorrectly when sendmsg fails 2021-04-12 12:51:09 +08:00
video udlfb: Fix memory leak in dlfb_usb_probe 2021-04-12 12:52:43 +08:00
virt virt: vbox: Do not use wait_event_interruptible when called from kernel context 2021-04-12 12:52:10 +08:00
virtio virtio_ring: Fix two use after free bugs 2021-03-16 16:43:19 +08:00
visorbus
…
vlynq
…
vme
…
w1 w1: mxc_w1: Fix timeout resolution problem leading to bus error 2021-03-16 16:39:58 +08:00
watchdog watchdog: mei_wdt: request stop on unregister 2021-04-12 12:52:38 +08:00
xen xen-scsiback: don't "handle" error by BUG() 2021-04-12 12:52:08 +08:00
zorro
…
Kconfig
…
Makefile
…