kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers/md
History
Yu Kuai e2a9f73ee4 md: fix mddev uaf while iterating all_mddevs list 
commit 8542870237 upstream.

While iterating all_mddevs list from md_notify_reboot() and md_exit(),
list_for_each_entry_safe is used, and this can race with deletint the
next mddev, causing UAF:

t1:
spin_lock
//list_for_each_entry_safe(mddev, n, ...)
 mddev_get(mddev1)
 // assume mddev2 is the next entry
 spin_unlock
            t2:
            //remove mddev2
            ...
            mddev_free
            spin_lock
            list_del
            spin_unlock
            kfree(mddev2)
 mddev_put(mddev1)
 spin_lock
 //continue dereference mddev2->all_mddevs

The old helper for_each_mddev() actually grab the reference of mddev2
while holding the lock, to prevent from being freed. This problem can be
fixed the same way, however, the code will be complex.

Hence switch to use list_for_each_entry, in this case mddev_put() can free
the mddev1 and it's not safe as well. Refer to md_seq_show(), also factor
out a helper mddev_put_locked() to fix this problem.

Cc: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/linux-raid/20250220124348.845222-1-yukuai1@huaweicloud.com
Fixes: f265143422 ("md: stop using for_each_mddev in md_notify_reboot")
Fixes: 16648bac86 ("md: stop using for_each_mddev in md_exit")
Reported-and-tested-by: Guillaume Morin <guillaume@morinfr.org>
Closes: https://lore.kernel.org/all/Z7Y0SURoA8xwg7vn@bender.morinfr.org/
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-04-25 10:48:04 +02:00
..
bcache bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again 2024-12-14 20:03:26 +01:00
dm-vdo dm vdo: add missing spin_lock_init 2025-03-07 18:25:44 +01:00
persistent-data dm array: fix cursor index when skipping across block boundaries 2025-01-17 13:40:34 +01:00
dm-audit.c dm: add missing SPDX-License-Indentifiers 2023-02-14 14:23:06 -05:00
dm-audit.h dm: introduce audit event module for device mapper 2021-10-27 16:53:47 -04:00
dm-bio-prison-v1.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-bio-prison-v1.h dm bio prison v1: add dm_cell_key_has_valid_range 2023-03-30 15:57:51 -04:00
dm-bio-prison-v2.c dm: use bio_list_merge_init 2024-04-01 11:53:37 -06:00
dm-bio-prison-v2.h dm: change "unsigned" to "unsigned int" 2023-02-14 14:23:06 -05:00
dm-bio-record.h dm: add missing SPDX-License-Indentifiers 2023-02-14 14:23:06 -05:00
dm-bufio.c dm-bufio: fix warnings about duplicate slab caches 2024-11-11 17:04:18 +01:00
dm-builtin.c dm: adjust EXPORT_SYMBOL() to follow functions immediately 2023-02-14 14:23:07 -05:00
dm-cache-background-tracker.c dm-cache: fix warnings about duplicate slab caches 2024-11-11 17:04:39 +01:00
dm-cache-background-tracker.h dm-cache: fix warnings about duplicate slab caches 2024-11-11 17:04:39 +01:00
dm-cache-block-types.h dm: add missing SPDX-License-Indentifiers 2023-02-14 14:23:06 -05:00
dm-cache-metadata.c dm: Constify struct dm_block_validator 2024-07-19 12:08:15 +02:00
dm-cache-metadata.h dm: change "unsigned" to "unsigned int" 2023-02-14 14:23:06 -05:00
dm-cache-policy-internal.h dm: add missing empty lines 2023-02-14 14:23:06 -05:00
dm-cache-policy-smq.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-cache-policy.c dm: change "unsigned" to "unsigned int" 2023-02-14 14:23:06 -05:00
dm-cache-policy.h dm: address indent/space issues 2023-02-14 14:23:06 -05:00
dm-cache-target.c dm-cache: fix warnings about duplicate slab caches 2024-11-11 17:04:39 +01:00
dm-clone-metadata.c dm: Make use of __assign_bit() API 2024-09-02 16:53:53 +02:00
dm-clone-metadata.h dm clone metadata: Fix return type of dm_clone_nr_of_hydrated_regions() 2020-03-27 14:42:51 -04:00
dm-clone-target.c dm: stop using blk_limits_io_{min,opt} 2024-07-10 13:10:06 +02:00
dm-core.h dm: optimize flushes 2024-06-26 11:32:39 -04:00
dm-crypt.c dm-crypt: track tag_offset in convert_context 2025-02-17 10:05:19 +01:00
dm-delay.c dm-delay: remove timer_lock 2024-05-09 09:10:58 -04:00
dm-dust.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-ebs-target.c dm-ebs: fix prefetch-vs-suspend race 2025-04-20 10:15:53 +02:00
dm-era-target.c dm: Constify struct dm_block_validator 2024-07-19 12:08:15 +02:00
dm-exception-store.c dm: change "unsigned" to "unsigned int" 2023-02-14 14:23:06 -05:00
dm-exception-store.h dm: avoid spaces before function arguments or in favour of tabs 2023-02-14 14:23:06 -05:00
dm-flakey.c dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature 2025-03-22 12:54:25 -07:00
dm-ima.c dm: avoid inline filenames 2023-02-14 14:23:07 -05:00
dm-ima.h dm: avoid inline filenames 2023-02-14 14:23:07 -05:00
dm-init.c dm init: Handle minors larger than 255 2024-07-02 20:53:41 +02:00
dm-integrity.c dm-integrity: fix non-constant-time tag verification 2025-04-20 10:15:53 +02:00
dm-io-rewind.c dm: avoid void function return statements 2023-02-14 14:23:07 -05:00
dm-io-tracker.h dm: add missing SPDX-License-Indentifiers 2023-02-14 14:23:06 -05:00
dm-io.c dm io: remove code duplication between sync_io and aysnc_io 2024-07-02 12:00:43 +02:00
dm-ioctl.c dm resume: don't return EINVAL when signalled 2024-08-13 13:51:34 +02:00
dm-kcopyd.c dm io: Support IO priority 2024-02-20 14:22:51 -05:00
dm-linear.c dm: optimize flushes 2024-06-26 11:32:39 -04:00
dm-log-userspace-base.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-log-userspace-transfer.c dm: avoid split of quoted strings where possible 2023-02-14 14:23:07 -05:00
dm-log-userspace-transfer.h dm: add missing SPDX-License-Indentifiers 2023-02-14 14:23:06 -05:00
dm-log-writes.c dm: always manage discard support in terms of max_hw_discard_sectors 2024-05-20 15:51:19 -04:00
dm-log.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-mpath.c dm mpath: don't call dm_get_device in multipath_message 2024-07-10 13:10:06 +02:00
dm-mpath.h dm: change "unsigned" to "unsigned int" 2023-02-14 14:23:06 -05:00
dm-path-selector.c dm: adjust EXPORT_SYMBOL() to follow functions immediately 2023-02-14 14:23:07 -05:00
dm-path-selector.h dm: avoid spaces before function arguments or in favour of tabs 2023-02-14 14:23:06 -05:00
dm-ps-historical-service-time.c dm: add missing SPDX-License-Indentifiers 2023-02-14 14:23:06 -05:00
dm-ps-io-affinity.c dm: address space issues relative to switch/while/for/... 2023-02-14 14:23:06 -05:00
dm-ps-queue-length.c dm: avoid spaces before function arguments or in favour of tabs 2023-02-14 14:23:06 -05:00
dm-ps-round-robin.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-ps-service-time.c dm: avoid spaces before function arguments or in favour of tabs 2023-02-14 14:23:06 -05:00
dm-raid.c - Misc VDO fixes 2024-09-27 09:12:51 -07:00
dm-raid1.c dm io: Support IO priority 2024-02-20 14:22:51 -05:00
dm-region-hash.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-rq.c Revert "dm: requeue IO if mapping table not yet available" 2024-09-15 21:02:54 +02:00
dm-rq.h dm: change "unsigned" to "unsigned int" 2023-02-14 14:23:06 -05:00
dm-snap-persistent.c dm io: Support IO priority 2024-02-20 14:22:51 -05:00
dm-snap-transient.c dm: avoid split of quoted strings where possible 2023-02-14 14:23:07 -05:00
dm-snap.c dm: always manage discard support in terms of max_hw_discard_sectors 2024-05-20 15:51:19 -04:00
dm-stats.c dm stats: limit the number of entries 2024-01-30 14:06:44 -05:00
dm-stats.h dm stats: check for and propagate alloc_percpu failure 2023-03-16 13:37:06 -04:00
dm-stripe.c dm: stop using blk_limits_io_{min,opt} 2024-07-10 13:10:06 +02:00
dm-switch.c dm: add helper macro for simple DM target module init and exit 2023-04-11 12:09:08 -04:00
dm-sysfs.c dm sysfs: make kobj_type structure constant 2023-02-14 14:23:08 -05:00
dm-table.c dm: introduce the target flag mempool_needs_integrity 2024-07-12 12:39:06 -04:00
dm-target.c dm: always manage discard support in terms of max_hw_discard_sectors 2024-05-20 15:51:19 -04:00
dm-thin-metadata.c dm: Constify struct dm_block_validator 2024-07-19 12:08:15 +02:00
dm-thin-metadata.h dm: add missing SPDX-License-Indentifiers 2023-02-14 14:23:06 -05:00
dm-thin.c dm thin: make get_first_thin use rcu-safe list first function 2025-01-17 13:40:45 +01:00
dm-uevent.c dm: avoid spaces before function arguments or in favour of tabs 2023-02-14 14:23:06 -05:00
dm-uevent.h dm: fix undue/missing spaces 2023-02-14 14:23:06 -05:00
dm-unstripe.c dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow 2024-11-04 17:34:56 +01:00
dm-verity-fec.c dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2) 2025-01-17 13:40:46 +01:00
dm-verity-fec.h dm-verity: always "map" the data blocks 2024-07-03 21:41:11 +02:00
dm-verity-loadpin.c dm: verity-loadpin: Add NULL pointer check for 'bdev' parameter 2023-06-28 10:43:04 -07:00
dm-verity-target.c dm-verity: fix prefetch-vs-suspend race 2025-04-20 10:15:53 +02:00
dm-verity-verify-sig.c dm verity: fallback to platform keyring also if key in trusted keyring is rejected 2024-09-26 17:27:08 +02:00
dm-verity-verify-sig.h dm: add missing SPDX-License-Indentifiers 2023-02-14 14:23:06 -05:00
dm-verity.h dm-verity: don't crash if panic_on_corruption is not selected 2024-11-04 17:39:23 +01:00
dm-writecache.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-zero.c dm: always manage discard support in terms of max_hw_discard_sectors 2024-05-20 15:51:19 -04:00
dm-zone.c dm: handle REQ_OP_ZONE_RESET_ALL 2024-07-05 00:42:04 -06:00
dm-zoned-metadata.c block: remove gfp_flags from blkdev_zone_mgmt 2024-02-12 08:41:16 -07:00
dm-zoned-reclaim.c dm: Fix dm-zoned-reclaim zone write pointer alignment 2024-12-19 18:13:00 +01:00
dm-zoned-target.c dm: stop using blk_limits_io_{min,opt} 2024-07-10 13:10:06 +02:00
dm-zoned.h dm/dm-zoned: Use the enum req_op type 2022-07-14 12:14:31 -06:00
dm.c dm: fix a crash if blk_alloc_disk fails 2024-10-15 13:37:17 +02:00
dm.h dm: Remove unused declaration and empty definition "dm_zone_map_bio" 2024-08-21 13:12:12 +02:00
Kconfig md: reintroduce md-linear 2025-02-17 10:05:04 +01:00
Makefile md: reintroduce md-linear 2025-02-17 10:05:04 +01:00
md-autodetect.c md: reintroduce md-linear 2025-02-17 10:05:04 +01:00
md-bitmap.c md/md-bitmap: fix stats collection for external bitmaps 2025-04-25 10:47:38 +02:00
md-bitmap.h md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() 2025-02-08 09:58:11 +01:00
md-cluster.c md/md-bitmap: make in memory structure internal 2024-08-27 12:43:16 -07:00
md-cluster.h md-cluster: fix no recovery job when adding/re-adding a disk 2024-07-12 01:30:18 +00:00
md-linear.c md: Fix linear_set_limits() 2025-02-17 10:05:47 +01:00
md.c md: fix mddev uaf while iterating all_mddevs list 2025-04-25 10:48:04 +02:00
md.h md/md-bitmap: move bitmap_{start, end}write to md upper layer 2025-02-08 09:58:12 +01:00
raid0.c md/raid*: Fix the set_queue_limits implementations 2025-02-27 04:30:19 -08:00
raid0.h md/raid0: add discard support for the 'original' layout 2023-06-30 15:43:50 -07:00
raid1-10.c md/md-bitmap: merge md_bitmap_enabled() into bitmap_operations 2024-08-27 12:43:16 -07:00
raid1.c md/raid*: Fix the set_queue_limits implementations 2025-02-27 04:30:19 -08:00
raid1.h md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() 2025-02-08 09:58:11 +01:00
raid5-cache.c md/md-bitmap: move bitmap_{start, end}write to md upper layer 2025-02-08 09:58:12 +01:00
raid5-log.h md/raid5-ppl: Drop unused argument from ppl_handle_flush_request() 2022-08-02 17:14:31 -06:00
raid5-ppl.c md: remove mddev->queue 2024-03-06 08:59:53 -08:00
raid5.c md/md-bitmap: move bitmap_{start, end}write to md upper layer 2025-02-08 09:58:12 +01:00
raid5.h md/md-bitmap: move bitmap_{start, end}write to md upper layer 2025-02-08 09:58:12 +01:00
raid10.c md/raid10: fix missing discard IO accounting 2025-04-25 10:47:38 +02:00
raid10.h md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() 2025-02-08 09:58:11 +01:00