• Z
    nbd: get config_lock before sock_shutdown · b3e3e34c
    Zhong Jinghua 提交于
    hulk inclusion
    category: bugfix
    bugzilla: 188799, https://gitee.com/openeuler/kernel/issues/I79QWO
    CVE: NA
    
    ----------------------------------------
    
    Config->socks in sock_shutdown may trigger a UAF problem.
    The reason is that sock_shutdown does not hold the config_lock,
    so that nbd_ioctl can release config->socks at this time.
    
    T0: NBD_SET_SOCK
    T1: NBD_DO_IT
    
    T0						T1
    
    nbd_ioctl
      mutex_lock(&nbd->config_lock)
      // get lock
      __nbd_ioctl
    	nbd_start_device_ioctl
    	  nbd_start_device
    	  mutex_unlock(&nbd->config_lock)
    	  // relase lock
    	  wait_event_interruptible
    	  (kill, enter sock_shutdown)
    	  sock_shutdown
    					nbd_ioctl
    					  mutex_lock(&nbd->config_lock)
    					  // get lock
    					  __nbd_ioctl
    					    nbd_add_socket
    					      krealloc
    						kfree(p)
    					        //config->socks is NULL
    	    nbd_sock *nsock = config->socks // error
    
    Fix it by moving config_lock up before sock_shutdown.
    Signed-off-by: NZhong Jinghua <zhongjinghua@huawei.com>
    b3e3e34c
nbd.c 64.5 KB