linux-stable.git/block/genhd.c, branch linux-3.10.y

block: fix del_gendisk() vs blkdev_ioctl crash

2017-06-20T06:02:37+00:00

commit ac34f15e0c6d2fd58480052b6985f6991fb53bcc upstream.

When tearing down a block device early in its lifetime, userspace may
still be performing discovery actions like blkdev_ioctl() to re-read
partitions.

The nvdimm_revalidate_disk() implementation depends on
disk->driverfs_dev to be valid at entry.  However, it is set to NULL in
del_gendisk() and fatally this is happening *before* the disk device is
deleted from userspace view.

There's no reason for del_gendisk() to clear ->driverfs_dev.  That
device is the parent of the disk.  It is guaranteed to not be freed
until the disk, as a child, drops its ->parent reference.

We could also fix this issue locally in nvdimm_revalidate_disk() by
using disk_to_dev(disk)->parent, but lets fix it globally since
->driverfs_dev follows the lifetime of the parent.  Longer term we
should probably just add a @parent parameter to add_disk(), and stop
carrying this pointer in the gendisk.

 BUG: unable to handle kernel NULL pointer dereference at           (null)
 IP: [] nvdimm_revalidate_disk+0x18/0x90 [libnvdimm]
 CPU: 2 PID: 538 Comm: systemd-udevd Tainted: G           O    4.4.0-rc5 #2257
 [..]
 Call Trace:
  [] rescan_partitions+0x87/0x2c0
  [] ? __lock_is_held+0x49/0x70
  [] __blkdev_reread_part+0x72/0xb0
  [] blkdev_reread_part+0x25/0x40
  [] blkdev_ioctl+0x4fd/0x9c0
  [] ? current_kernel_time64+0x69/0xd0
  [] block_ioctl+0x3d/0x50
  [] do_vfs_ioctl+0x308/0x560
  [] ? __audit_syscall_entry+0xb1/0x100
  [] ? do_audit_syscall_entry+0x66/0x70
  [] SyS_ioctl+0x79/0x90
  [] entry_SYSCALL_64_fastpath+0x12/0x76

Cc: Jan Kara 
Cc: Jens Axboe 
Reported-by: Robert Hu 
Signed-off-by: Dan Williams 
Signed-off-by: Willy Tarreau

block: fix use-after-free in seq file

2016-08-27T09:40:34+00:00

commit 77da160530dd1dc94f6ae15a981f24e5f0021e84 upstream.

I got a KASAN report of use-after-free:

    ==================================================================
    BUG: KASAN: use-after-free in klist_iter_exit+0x61/0x70 at addr ffff8800b6581508
    Read of size 8 by task trinity-c1/315
    =============================================================================
    BUG kmalloc-32 (Not tainted): kasan: bad access detected
    -----------------------------------------------------------------------------

    Disabling lock debugging due to kernel taint
    INFO: Allocated in disk_seqf_start+0x66/0x110 age=144 cpu=1 pid=315
            ___slab_alloc+0x4f1/0x520
            __slab_alloc.isra.58+0x56/0x80
            kmem_cache_alloc_trace+0x260/0x2a0
            disk_seqf_start+0x66/0x110
            traverse+0x176/0x860
            seq_read+0x7e3/0x11a0
            proc_reg_read+0xbc/0x180
            do_loop_readv_writev+0x134/0x210
            do_readv_writev+0x565/0x660
            vfs_readv+0x67/0xa0
            do_preadv+0x126/0x170
            SyS_preadv+0xc/0x10
            do_syscall_64+0x1a1/0x460
            return_from_SYSCALL_64+0x0/0x6a
    INFO: Freed in disk_seqf_stop+0x42/0x50 age=160 cpu=1 pid=315
            __slab_free+0x17a/0x2c0
            kfree+0x20a/0x220
            disk_seqf_stop+0x42/0x50
            traverse+0x3b5/0x860
            seq_read+0x7e3/0x11a0
            proc_reg_read+0xbc/0x180
            do_loop_readv_writev+0x134/0x210
            do_readv_writev+0x565/0x660
            vfs_readv+0x67/0xa0
            do_preadv+0x126/0x170
            SyS_preadv+0xc/0x10
            do_syscall_64+0x1a1/0x460
            return_from_SYSCALL_64+0x0/0x6a

    CPU: 1 PID: 315 Comm: trinity-c1 Tainted: G    B           4.7.0+ #62
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
     ffffea0002d96000 ffff880119b9f918 ffffffff81d6ce81 ffff88011a804480
     ffff8800b6581500 ffff880119b9f948 ffffffff8146c7bd ffff88011a804480
     ffffea0002d96000 ffff8800b6581500 fffffffffffffff4 ffff880119b9f970
    Call Trace:
     [] dump_stack+0x65/0x84
     [] print_trailer+0x10d/0x1a0
     [] object_err+0x2f/0x40
     [] kasan_report_error+0x221/0x520
     [] __asan_report_load8_noabort+0x3e/0x40
     [] klist_iter_exit+0x61/0x70
     [] class_dev_iter_exit+0x9/0x10
     [] disk_seqf_stop+0x3a/0x50
     [] seq_read+0x4b2/0x11a0
     [] proc_reg_read+0xbc/0x180
     [] do_loop_readv_writev+0x134/0x210
     [] do_readv_writev+0x565/0x660
     [] vfs_readv+0x67/0xa0
     [] do_preadv+0x126/0x170
     [] SyS_preadv+0xc/0x10

This problem can occur in the following situation:

open()
 - pread()
    - .seq_start()
       - iter = kmalloc() // succeeds
       - seqf->private = iter
    - .seq_stop()
       - kfree(seqf->private)
 - pread()
    - .seq_start()
       - iter = kmalloc() // fails
    - .seq_stop()
       - class_dev_iter_exit(seqf->private) // boom! old pointer

As the comment in disk_seqf_stop() says, stop is called even if start
failed, so we need to reinitialise the private pointer to NULL when seq
iteration stops.

An alternative would be to set the private pointer to NULL when the
kmalloc() in disk_seqf_start() fails.

Cc: stable@vger.kernel.org
Signed-off-by: Vegard Nossum 
Acked-by: Tejun Heo 
Signed-off-by: Jens Axboe 
Signed-off-by: Willy Tarreau

block: fix ext_dev_lock lockdep report

2015-06-22T23:55:52+00:00

commit 4d66e5e9b6d720d8463e11d027bd4ad91c8b1318 upstream.

 =================================
 [ INFO: inconsistent lock state ]
 4.1.0-rc7+ #217 Tainted: G           O
 ---------------------------------
 inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
 swapper/6/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
  (ext_devt_lock){+.?...}, at: [] blk_free_devt+0x3c/0x70
 {SOFTIRQ-ON-W} state was registered at:
   [] __lock_acquire+0x461/0x1e70
   [] lock_acquire+0xb7/0x290
   [] _raw_spin_lock+0x38/0x50
   [] blk_alloc_devt+0x6d/0xd0  <-- take the lock in process context
[..]
  [] __lock_acquire+0x3fe/0x1e70
  [] ? __lock_acquire+0xe5d/0x1e70
  [] lock_acquire+0xb7/0x290
  [] ? blk_free_devt+0x3c/0x70
  [] _raw_spin_lock+0x38/0x50
  [] ? blk_free_devt+0x3c/0x70
  [] blk_free_devt+0x3c/0x70    <-- take the lock in softirq
  [] part_release+0x1c/0x50
  [] device_release+0x36/0xb0
  [] kobject_cleanup+0x7b/0x1a0
  [] kobject_put+0x30/0x70
  [] put_device+0x17/0x20
  [] delete_partition_rcu_cb+0x16c/0x180
  [] ? read_dev_sector+0xa0/0xa0
  [] rcu_process_callbacks+0x2ff/0xa90
  [] ? rcu_process_callbacks+0x2bf/0xa90
  [] __do_softirq+0xde/0x600

Neil sees this in his tests and it also triggers on pmem driver unbind
for the libnvdimm tests.  This fix is on top of an initial fix by Keith
for incorrect usage of mutex_lock() in this path: 2da78092dda1 "block:
Fix dev_t minor allocation lifetime".  Both this and 2da78092dda1 are
candidates for -stable.

Fixes: 2da78092dda1 ("block: Fix dev_t minor allocation lifetime")
Cc: Keith Busch 
Reported-by: NeilBrown 
Signed-off-by: Dan Williams 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

genhd: check for int overflow in disk_expand_part_tbl()

2015-01-16T14:59:02+00:00

commit 5fabcb4c33fe11c7e3afdf805fde26c1a54d0953 upstream.

We can get here from blkdev_ioctl() -> blkpg_ioctl() -> add_partition()
with a user passed in partno value. If we pass in 0x7fffffff, the
new target in disk_expand_part_tbl() overflows the 'int' and we
access beyond the end of ptbl->part[] and even write to it when we
do the rcu_assign_pointer() to assign the new partition.

Reported-by: David Ramos 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

genhd: fix leftover might_sleep() in blk_free_devt()

2014-10-05T21:54:13+00:00

commit 46f341ffcfb5d8530f7d1e60f3be06cce6661b62 upstream.

Commit 2da78092 changed the locking from a mutex to a spinlock,
so we now longer sleep in this context. But there was a leftover
might_sleep() in there, which now triggers since we do the final
free from an RCU callback. Get rid of it.

Reported-by: Pontus Fuchs 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

block: Fix dev_t minor allocation lifetime

2014-10-05T21:54:12+00:00

commit 2da78092dda13f1efd26edbbf99a567776913750 upstream.

Releases the dev_t minor when all references are closed to prevent
another device from acquiring the same major/minor.

Since the partition's release may be invoked from call_rcu's soft-irq
context, the ext_dev_idr's mutex had to be replaced with a spinlock so
as not so sleep.

Signed-off-by: Keith Busch 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

block: do not pass disk names as format strings

2013-07-13T18:42:26+00:00

commit ffc8b30866879ed9ba62bd0a86fecdbd51cd3d19 upstream.

Disk names may contain arbitrary strings, so they must not be
interpreted as format strings.  It seems that only md allows arbitrary
strings to be used for disk names, but this could allow for a local
memory corruption from uid 0 into ring 0.

CVE-2013-2851

Signed-off-by: Kees Cook 
Cc: Jens Axboe 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

driver core: handle user namespaces properly with the uid/gid devtmpfs change

2013-04-11T18:43:29+00:00

Now that devtmpfs is caring about uid/gid, we need to use the correct
internal types so users who have USER_NS enabled will have things work
properly for them.

Thanks to Eric for pointing this out, and the patch review.

Reported-by: Eric W. Biederman 
Cc: Kay Sievers 
Cc: Ming Lei 
Signed-off-by: Greg Kroah-Hartman

driver core: add uid and gid to devtmpfs

2013-04-08T15:21:48+00:00

Some drivers want to tell userspace what uid and gid should be used for
their device nodes, so allow that information to percolate through the
driver core to userspace in order to make this happen.  This means that
some systems (i.e.  Android and friends) will not need to even run a
udev-like daemon for their device node manager and can just rely in
devtmpfs fully, reducing their footprint even more.

Signed-off-by: Kay Sievers 
Signed-off-by: Greg Kroah-Hartman

block: convert to idr_alloc()

2013-02-28T03:10:15+00:00

Convert to the much saner new idr interface.  Both bsg and genhd
protect idr w/ mutex making preloading unnecessary.

Signed-off-by: Tejun Heo 
Acked-by: Jens Axboe 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds