lkml.org 
[lkml]   [2020]   [Apr]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.5 12/56] null_blk: Handle null_add_dev() failures properly
    Date
    From: Bart Van Assche <bvanassche@acm.org>

    [ Upstream commit 9b03b713082a31a5b90e0a893c72aa620e255c26 ]

    If null_add_dev() fails then null_del_dev() is called with a NULL argument.
    Make null_del_dev() handle this scenario correctly. This patch fixes the
    following KASAN complaint:

    null-ptr-deref in null_del_dev+0x28/0x280 [null_blk]
    Read of size 8 at addr 0000000000000000 by task find/1062

    Call Trace:
    dump_stack+0xa5/0xe6
    __kasan_report.cold+0x65/0x99
    kasan_report+0x16/0x20
    __asan_load8+0x58/0x90
    null_del_dev+0x28/0x280 [null_blk]
    nullb_group_drop_item+0x7e/0xa0 [null_blk]
    client_drop_item+0x53/0x80 [configfs]
    configfs_rmdir+0x395/0x4e0 [configfs]
    vfs_rmdir+0xb6/0x220
    do_rmdir+0x238/0x2c0
    __x64_sys_unlinkat+0x75/0x90
    do_syscall_64+0x6f/0x2f0
    entry_SYSCALL_64_after_hwframe+0x49/0xbe

    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
    Cc: Johannes Thumshirn <jth@kernel.org>
    Cc: Hannes Reinecke <hare@suse.com>
    Cc: Ming Lei <ming.lei@redhat.com>
    Cc: Christoph Hellwig <hch@infradead.org>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/block/null_blk_main.c | 7 ++++++-
    1 file changed, 6 insertions(+), 1 deletion(-)

    diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
    index 97bb53d7fa348..635904bfcf777 100644
    --- a/drivers/block/null_blk_main.c
    +++ b/drivers/block/null_blk_main.c
    @@ -1432,7 +1432,12 @@ static void cleanup_queues(struct nullb *nullb)

    static void null_del_dev(struct nullb *nullb)
    {
    - struct nullb_device *dev = nullb->dev;
    + struct nullb_device *dev;
    +
    + if (!nullb)
    + return;
    +
    + dev = nullb->dev;

    ida_simple_remove(&nullb_indexes, nullb->index);

    --
    2.20.1
    \
     
     \ /
      Last update: 2020-04-10 05:48    [W:2.123 / U:0.332 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site