• B
    null_blk: Fix the null_add_dev() error path · 2004bfde
    Bart Van Assche 提交于
    If null_add_dev() fails, clear dev->nullb.
    
    This patch fixes the following KASAN complaint:
    
    BUG: KASAN: use-after-free in nullb_device_submit_queues_store+0xcf/0x160 [null_blk]
    Read of size 8 at addr ffff88803280fc30 by task check/8409
    
    Call Trace:
     dump_stack+0xa5/0xe6
     print_address_description.constprop.0+0x26/0x260
     __kasan_report.cold+0x7b/0x99
     kasan_report+0x16/0x20
     __asan_load8+0x58/0x90
     nullb_device_submit_queues_store+0xcf/0x160 [null_blk]
     configfs_write_file+0x1c4/0x250 [configfs]
     __vfs_write+0x4c/0x90
     vfs_write+0x145/0x2c0
     ksys_write+0xd7/0x180
     __x64_sys_write+0x47/0x50
     do_syscall_64+0x6f/0x2f0
     entry_SYSCALL_64_after_hwframe+0x49/0xbe
    RIP: 0033:0x7ff370926317
    Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
    RSP: 002b:00007fff2dd2da48 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
    RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007ff370926317
    RDX: 0000000000000002 RSI: 0000559437ef23f0 RDI: 0000000000000001
    RBP: 0000559437ef23f0 R08: 000000000000000a R09: 0000000000000001
    R10: 0000559436703471 R11: 0000000000000246 R12: 0000000000000002
    R13: 00007ff370a006a0 R14: 00007ff370a014a0 R15: 00007ff370a008a0
    
    Allocated by task 8409:
     save_stack+0x23/0x90
     __kasan_kmalloc.constprop.0+0xcf/0xe0
     kasan_kmalloc+0xd/0x10
     kmem_cache_alloc_node_trace+0x129/0x4c0
     null_add_dev+0x24a/0xe90 [null_blk]
     nullb_device_power_store+0x1b6/0x270 [null_blk]
     configfs_write_file+0x1c4/0x250 [configfs]
     __vfs_write+0x4c/0x90
     vfs_write+0x145/0x2c0
     ksys_write+0xd7/0x180
     __x64_sys_write+0x47/0x50
     do_syscall_64+0x6f/0x2f0
     entry_SYSCALL_64_after_hwframe+0x49/0xbe
    
    Freed by task 8409:
     save_stack+0x23/0x90
     __kasan_slab_free+0x112/0x160
     kasan_slab_free+0x12/0x20
     kfree+0xdf/0x250
     null_add_dev+0xaf3/0xe90 [null_blk]
     nullb_device_power_store+0x1b6/0x270 [null_blk]
     configfs_write_file+0x1c4/0x250 [configfs]
     __vfs_write+0x4c/0x90
     vfs_write+0x145/0x2c0
     ksys_write+0xd7/0x180
     __x64_sys_write+0x47/0x50
     do_syscall_64+0x6f/0x2f0
     entry_SYSCALL_64_after_hwframe+0x49/0xbe
    
    Fixes: 2984c868 ("nullb: factor disk parameters")
    Signed-off-by: NBart Van Assche <bvanassche@acm.org>
    Reviewed-by: NChaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
    Cc: Johannes Thumshirn <jth@kernel.org>
    Cc: Hannes Reinecke <hare@suse.com>
    Cc: Ming Lei <ming.lei@redhat.com>
    Cc: Christoph Hellwig <hch@infradead.org>
    Signed-off-by: NJens Axboe <axboe@kernel.dk>
    2004bfde
null_blk_main.c 45.7 KB