kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Yang Erkun 63dfd728b3 brd: defer automatic disk creation until module initialization succeeds 
[ Upstream commit 826cc42adf ]

My colleague Wupeng found the following problems during fault injection:

BUG: unable to handle page fault for address: fffffbfff809d073
PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.16.1-2.fc37 04/01/2014
RIP: 0010:__asan_load8+0x4c/0xa0
...
Call Trace:
 <TASK>
 blkdev_put_whole+0x41/0x70
 bdev_release+0x1a3/0x250
 blkdev_release+0x11/0x20
 __fput+0x1d7/0x4a0
 task_work_run+0xfc/0x180
 syscall_exit_to_user_mode+0x1de/0x1f0
 do_syscall_64+0x6b/0x170
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

loop_init() is calling loop_add() after __register_blkdev() succeeds and
is ignoring disk_add() failure from loop_add(), for loop_add() failure
is not fatal and successfully created disks are already visible to
bdev_open().

brd_init() is currently calling brd_alloc() before __register_blkdev()
succeeds and is releasing successfully created disks when brd_init()
returns an error. This can cause UAF for the latter two case:

case 1:
    T1:
modprobe brd
  brd_init
    brd_alloc(0) // success
      add_disk
        disk_scan_partitions
          bdev_file_open_by_dev // alloc file
          fput // won't free until back to userspace
    brd_alloc(1) // failed since mem alloc error inject
  // error path for modprobe will release code segment
  // back to userspace
  __fput
    blkdev_release
      bdev_release
        blkdev_put_whole
          bdev->bd_disk->fops->release // fops is freed now, UAF!

case 2:
    T1:                            T2:
modprobe brd
  brd_init
    brd_alloc(0) // success
                                   open(/dev/ram0)
    brd_alloc(1) // fail
  // error path for modprobe

                                   close(/dev/ram0)
                                   ...
                                   /* UAF! */
                                   bdev->bd_disk->fops->release

Fix this problem by following what loop_init() does. Besides,
reintroduce brd_devices_mutex to help serialize modifications to
brd_list.

Fixes: 7f9b348cb5 ("brd: convert to blk_alloc_disk/blk_cleanup_disk")
Reported-by: Wupeng Ma <mawupeng1@huawei.com>
Signed-off-by: Yang Erkun <yangerkun@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20241030034914.907829-1-yangerkun@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-12-05 14:01:12 +01:00
..
accel accel/ivpu: Fix NOC firewall interrupt handling 2024-10-30 10:17:00 +01:00
accessibility treewide: remove unnecessary <linux/version.h> inclusion 2024-08-12 18:36:44 +09:00
acpi ACPI: processor: Move arch_init_invariance_cppc() call later 2024-11-06 21:31:36 +01:00
amba ARM: 9416/1: amba: make amba_bustype constant 2024-09-04 15:01:17 +01:00
android binder: modify the comment for binder_proc_unlock 2024-09-11 16:02:45 +02:00
ata ata: libata: Set DID_TIME_OUT for commands that actually timed out 2024-10-24 11:14:00 +02:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-08-12 10:41:44 +01:00
auxdisplay move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
base ACPI: processor: Move arch_init_invariance_cppc() call later 2024-11-06 21:31:36 +01:00
bcma PCI: Rename CRS Completion Status to RRS 2024-09-10 19:52:30 -05:00
block brd: defer automatic disk creation until module initialization succeeds 2024-12-05 14:01:12 +01:00
bluetooth Bluetooth: btintel: Direct exception event to bluetooth stack 2024-11-12 11:39:12 -05:00
bus Driver core update for 6.12-rc1 2024-09-27 08:48:37 -07:00
cache cache: StarFive: Require a 64-bit system 2024-08-01 07:15:02 -07:00
cdrom cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed() 2024-10-17 19:47:15 -06:00
cdx cdx: remove unused struct 'cdx_mcdi_copy_buffer' 2024-07-31 13:56:50 +02:00
char tpm: Disable TPM on tpm2_create_primary() failure 2024-11-13 21:10:45 +02:00
clk A handful of Qualcomm clk driver fixes: 2024-11-10 14:16:28 -08:00
clocksource Updates for x86 timers: 2024-09-17 15:27:01 +02:00
comedi move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-13 11:15:44 +01:00
counter move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
cpufreq cpufreq: intel_pstate: Rearrange locking in hybrid_init_cpu_capacity_scaling() 2024-11-11 15:18:41 +01:00
cpuidle pmdomain core: 2024-09-18 10:49:45 +02:00
crypto This push fixes the following issues: 2024-10-16 08:42:54 -07:00
cxl cxl/port: Prevent out-of-order decoder allocation 2024-10-25 16:07:03 -05:00
dax device-dax: correct pgoff align in dax_set_mapping() 2024-10-09 12:47:19 -07:00
dca Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
devfreq PM / devfreq: imx-bus: Use of_property_present() 2024-09-05 01:23:56 +09:00
dio dio: Have dio_bus_match() callback take a const * 2024-07-10 15:38:14 +02:00
dma dmaengine fixes for v6.12 2024-11-03 10:15:50 -10:00
dma-buf drm next for 6.12-rc1 2024-09-19 10:18:15 +02:00
dpll dpll: add Embedded SYNC feature for a pin 2024-08-26 19:21:14 -07:00
edac EDAC/qcom: Make irq configuration optional 2024-10-05 22:17:08 -05:00
eisa driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
extcon Char/Misc and other driver changes for 6.12-rc1 2024-09-26 10:13:08 -07:00
firewire firewire: core: fix invalid port index for parent device 2024-10-27 11:14:35 +09:00
firmware pmdomain core: 2024-11-15 10:20:17 -08:00
fpga move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
fsi move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
gnss [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
gpio gpiolib: fix debugfs dangling chip separator 2024-10-31 19:14:17 +01:00
gpu drm/amd/display: Fix incorrect DSC recompute trigger 2024-12-05 14:01:10 +01:00
greybus move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
hid hid-for-linus-20241105 2024-11-06 07:49:54 -10:00
hsi HSI: omap-ssi: Remove unnecessary debugfs_create_dir() error check 2024-08-27 15:28:56 +02:00
hte hte: tegra-194: add missing MODULE_DESCRIPTION() macro 2024-06-19 12:24:03 -07:00
hv drm next for 6.12-rc1 2024-09-19 10:18:15 +02:00
hwmon [PATCH} hwmon: (jc42) Properly detect TSE2004-compliant devices again 2024-10-14 19:14:08 -07:00
hwspinlock hwspinlock: qcom: implement bust operation 2024-05-29 12:52:26 -07:00
hwtracing [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
i2c i2c: designware: do not hold SCL low when I2C_DYNAMIC_TAR_UPDATE is not set 2024-11-08 19:13:06 +01:00
i3c i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition 2024-09-17 16:51:45 +02:00
idle intel_idle: fix ACPI _CST matching for newer Xeon platforms 2024-09-25 22:30:33 +02:00
iio iio: dac: Kconfig: Fix build error for ltc2664 2024-10-24 18:46:04 +01:00
infiniband Revert "RDMA/core: Fix ENODEV error for iWARP test over vlan" 2024-11-12 09:53:11 -05:00
input Input updates for v6.12-rc5 2024-11-03 08:35:29 -10:00
interconnect Merge branch 'icc-sm8350' into icc-next 2024-08-26 01:36:44 +03:00
iommu iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices 2024-10-15 10:17:54 +02:00
ipack driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
irqchip irqchip/gic-v3: Force propagation of the active state with a read-back 2024-11-07 00:22:44 +01:00
isdn move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
leds move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
macintosh move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
mailbox mailbox: qcom-cpucp: Mark the irq with IRQF_NO_SUSPEND flag 2024-11-12 19:45:25 +01:00
mcb Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
md dm-cache: fix warnings about duplicate slab caches 2024-11-11 17:04:39 +01:00
media media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format 2024-11-22 15:30:26 +01:00
memory memory: pl353-smc: simplify with scoped for each OF child loop 2024-08-31 07:44:24 +02:00
memstick move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
message SCSI misc on 20240928 2024-09-29 09:22:34 -07:00
mfd move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
misc mei: use kvmalloc for read buffer 2024-10-29 04:01:40 +01:00
mmc Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" 2024-11-12 19:40:40 +01:00
most Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
mtd move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
mux mux: remove usage of the deprecated ida_simple_xx() API 2024-04-29 08:20:07 -07:00
net bonding: add ns target multicast address to slave device 2024-11-14 11:16:28 +01:00
nfc move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
ntb ntb: Force physically contiguous allocation of rx ring buffers 2024-09-20 10:51:25 -04:00
nubus nubus: Make nubus_bus_type static and constant 2024-01-03 13:33:59 +01:00
nvdimm virtio: features, fixes, cleanups 2024-09-26 08:43:17 -07:00
nvme block-6.12-20241108 2024-11-09 12:55:32 -08:00
nvmem Char/Misc and other driver changes for 6.12-rc1 2024-09-26 10:13:08 -07:00
of of: Skip kunit tests when arm64+ACPI doesn't populate root node 2024-10-10 12:43:01 -05:00
opp OPP: fix error code in dev_pm_opp_set_config() 2024-10-02 01:27:50 +02:00
parisc parisc: pdc_stable: Constify struct kobj_type 2024-09-09 08:53:17 +02:00
parport parport: Proper fix for array out-of-bounds access 2024-10-13 18:17:35 +02:00
pci pci-v6.12-fixes-2 2024-11-01 15:44:23 -10:00
pcmcia move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
peci move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
perf drivers: perf: Fix wrong put_cpu() placement 2024-11-12 07:34:27 -08:00
phy phy: tegra: xusb: Add error pointer check in xusb.c 2024-10-21 23:34:42 +05:30
pinctrl pinctrl: ocelot: fix system hang on level based interrupts 2024-10-12 22:04:38 +02:00
platform platform-drivers-x86 for v6.12-4 2024-11-06 08:03:19 -10:00
pmdomain pmdomain: imx93-blk-ctrl: correct remove path 2024-11-01 12:53:16 +01:00
pnp driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
power move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
powercap powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request() 2024-10-21 13:23:06 +02:00
pps [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
ps3 driver/ps3: Include <video/cmdline.h> for mode parsing 2023-02-20 14:56:51 +01:00
ptp move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
pwm pwm: imx-tpm: Use correct MODULO value for EPWM mode 2024-10-25 11:29:17 +02:00
rapidio driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
ras RAS/AMD/ATL: Translate normalized to system physical addresses using PRM 2024-08-01 14:36:29 +02:00
regulator regulator: rk808: Add apply_bit for BUCK3 on RK809 2024-11-01 14:47:08 +00:00
remoteproc mhu-v3, omap2+ : fix kconfig dependencies 2024-09-29 09:53:04 -07:00
reset reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC 2024-09-30 14:24:37 +02:00
rpmsg rpmsg: glink: Handle rejected intent request better 2024-10-24 13:03:37 -05:00
rtc move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
s390 s390/cio: Do not unregister the subchannel based on DNV 2024-12-05 14:01:11 +01:00
sbus [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
scsi SCSI fixes on 20241108 2024-11-08 09:56:27 -10:00
sh sh: intc: Replace simple_strtoul() with kstrtoul() 2024-09-26 17:25:29 +02:00
siox Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
slimbus slimbus: qcom-ngd-ctrl: use 'time_left' variable with wait_for_completion_timeout() 2024-09-03 12:10:38 +02:00
soc Qualcomm driver fixes for v6.12 2024-11-04 14:23:09 +01:00
soundwire soundwire: intel_ace2x: Send PDI stream number during prepare 2024-10-17 12:11:19 +01:00
spi spi: spi-fsl-dspi: Fix crash when not using GPIO chip select 2024-10-23 22:37:54 +01:00
spmi spmi: pmic-arb: add missing newline in dev_err format strings 2024-07-31 13:49:28 +02:00
ssb driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
staging Staging driver fixes for 6.12-rc7 2024-11-10 08:53:24 -08:00
target SCSI fixes on 20241019 2024-10-19 12:52:19 -07:00
tc driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
tee optee: Fix a NULL vs IS_ERR() check 2024-09-09 12:22:06 +02:00
thermal thermal/of: support thermal zones w/o trips subnode 2024-11-04 15:38:29 +01:00
thunderbolt thunderbolt: Fixes for v6.12-rc7 2024-11-07 16:11:57 +01:00
tty serial: qcom-geni: rename suspend functions 2024-10-11 08:39:24 +02:00
ufs SCSI fixes on 20241108 2024-11-08 09:56:27 -10:00
uio uio: Constify struct kobj_type 2024-09-11 16:02:54 +02:00
usb USB-serial fixes for 6.12-rc7 2024-11-08 08:36:31 +01:00
vdpa vdpa/mlx5: Fix PA offset with unaligned starting iotlb map 2024-11-12 18:05:04 -05:00
vfio [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
vhost virtio: bugfixes 2024-10-07 11:33:26 -07:00
video fbdev: wm8505fb: select CONFIG_FB_IOMEM_FOPS 2024-10-21 11:16:51 +02:00
virt [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
virtio virtio_pci: Fix admin vq cleanup by using correct info pointer 2024-11-06 04:40:07 -05:00
w1 w1: ds2482: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-09-06 19:18:32 +02:00
watchdog move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
xen xen: Remove dependency between pciback and privcmd 2024-10-18 11:59:04 +02:00
zorro Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
Kconfig - removed AR7 platform support 2023-11-10 09:19:46 -08:00
Makefile leds: Init leds class earlier 2024-09-04 17:24:58 -05:00