Skip to content

cloud-kernel
cloud-kernel

openanolis / cloud-kernel
接近 2 年 前同步成功

通知 170
Star 36
Fork 7
cloud-kernel
cloud-kernel
切换分支/标签
  1. 03 7月, 2018 1 次提交
  3. 02 7月, 2018 1 次提交
    • L
      drbd: fix access after free · 64dafbc9
      由 Lars Ellenberg 提交于 
      We have
  struct drbd_requests { ... struct bio *private_bio;  ... }
to hold a bio clone for local submission.

On local IO completion, we put that bio, and in case we want to use the
result later, we overload that member to hold the ERR_PTR() of the
completion result,

Which, before v4.3, used to be the passed in "int error",
so we could first bio_put(), then assign.

v4.3-rc1~100^2~21 4246a0b6 block: add a bi_error field to struct bio
changed that:
  	bio_put(req->private_bio);
 -	req->private_bio = ERR_PTR(error);
 +	req->private_bio = ERR_PTR(bio->bi_error);

Which introduces an access after free,
because it was non obvious that req->private_bio == bio.

Impact of that was mostly unnoticable, because we only use that value
in a multiple-failure case, and even then map any "unexpected" error
code to EIO, so worst case we could potentially mask a more specific
error with EIO in a multiple failure case.

Unless the pointed to memory region was unmapped, as is the case with
CONFIG_DEBUG_PAGEALLOC, in which case this results in

  BUG: unable to handle kernel paging request

v4.13-rc1~70^2~75 4e4cbee9 block: switch bios to blk_status_t
changes it further to
  	bio_put(req->private_bio);
  	req->private_bio = ERR_PTR(blk_status_to_errno(bio->bi_status));

And blk_status_to_errno() now contains a WARN_ON_ONCE() for unexpected
values, which catches this "sometimes", if the memory has been reused
quickly enough for other things.

Should also go into stable since 4.3, with the trivial change around 4.13.

Cc: stable@vger.kernel.org
Fixes: 4246a0b6 block: add a bi_error field to struct bio
Reported-by: NSarah Newman <srn@prgmr.com>
Signed-off-by: NLars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: NJens Axboe <axboe@kernel.dk>
      64dafbc9
  5. 29 6月, 2018 1 次提交
  7. 21 6月, 2018 1 次提交
  9. 20 6月, 2018 1 次提交
  11. 08 6月, 2018 4 次提交
  13. 05 6月, 2018 3 次提交
  15. 31 5月, 2018 5 次提交
  17. 29 5月, 2018 4 次提交
  19. 25 5月, 2018 1 次提交
  21. 24 5月, 2018 1 次提交
  23. 23 5月, 2018 1 次提交
  25. 22 5月, 2018 1 次提交
    • J
      loop: clear wb_err in bd_inode when detaching backing file · eedffa28
      由 Jeff Layton 提交于 
      When a loop block device encounters a writeback error, that error will
get propagated to the bd_inode's wb_err field. If we then detach the
backing file from it, attach another and fsync it, we'll get back the
writeback error that we had from the previous backing file.

This is a bit of a grey area as POSIX doesn't cover loop devices, but it
is somewhat counterintuitive.

If we detach a backing file from the loopdev while there are still
unreported errors, take it as a sign that we're no longer interested in
the previous file, and clear out the wb_err in the loop blockdev.
Reported-and-Tested-by: NTheodore Y. Ts'o <tytso@mit.edu>
Signed-off-by: NJeff Layton <jlayton@redhat.com>
Signed-off-by: NJens Axboe <axboe@kernel.dk>
      eedffa28
  27. 17 5月, 2018 6 次提交
  29. 16 5月, 2018 2 次提交
  31. 15 5月, 2018 1 次提交
  33. 14 5月, 2018 2 次提交
  35. 12 5月, 2018 4 次提交