kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/staging
History
Gao Xiang 54d0b69a75 staging: erofs: fix use-after-free of on-stack `z_erofs_vle_unzip_io' 
[ Upstream commit 848bd9acdc ]

The root cause is the race as follows:
 Thread #0                         Thread #1

 z_erofs_vle_unzip_kickoff         z_erofs_submit_and_unzip

                                    struct z_erofs_vle_unzip_io io[]
   atomic_add_return()
                                    wait_event()
                                    [end of function]
   wake_up()

Fix it by taking the waitqueue lock between atomic_add_return and
wake_up to close such the race.

kernel message:

Unable to handle kernel paging request at virtual address 97f7052caa1303dc
...
Workqueue: kverityd verity_work
task: ffffffe32bcb8000 task.stack: ffffffe3298a0000
PC is at __wake_up_common+0x48/0xa8
LR is at __wake_up+0x3c/0x58
...
Call trace:
...
[<ffffff94a08ff648>] __wake_up_common+0x48/0xa8
[<ffffff94a08ff8b8>] __wake_up+0x3c/0x58
[<ffffff94a0c11b60>] z_erofs_vle_unzip_kickoff+0x40/0x64
[<ffffff94a0c118e4>] z_erofs_vle_read_endio+0x94/0x134
[<ffffff94a0c83c9c>] bio_endio+0xe4/0xf8
[<ffffff94a1076540>] dec_pending+0x134/0x32c
[<ffffff94a1076f28>] clone_endio+0x90/0xf4
[<ffffff94a0c83c9c>] bio_endio+0xe4/0xf8
[<ffffff94a1095024>] verity_work+0x210/0x368
[<ffffff94a08c4150>] process_one_work+0x188/0x4b4
[<ffffff94a08c45bc>] worker_thread+0x140/0x458
[<ffffff94a08cad48>] kthread+0xec/0x108
[<ffffff94a0883ab4>] ret_from_fork+0x10/0x1c
Code: d1006273 54000260 f9400804 b9400019 (b85fc081)
---[ end trace be9dde154f677cd1 ]---

Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2019-01-26 09:20:44 +01:00
..
android mm: remove CONFIG_HAVE_MEMBLOCK 2018-10-31 08:54:15 -07:00
axis-fifo staging: axis-fifo: remove duplicated include from axis-fifo.c 2018-10-09 15:13:23 +02:00
board staging: board: Replace license boilerplate with SPDX identifiers 2018-05-06 19:11:23 -07:00
clocking-wizard staging: clocking-wizard: match parenthesis indentation 2018-10-09 14:57:33 +02:00
comedi staging: comedi: clarify/unify macros for NI macro-defined terminals 2018-11-07 13:08:28 +01:00
emxx_udc staging: emxx_udc: Remove unused device_desc declaration 2018-10-09 15:13:24 +02:00
erofs staging: erofs: fix use-after-free of on-stack `z_erofs_vle_unzip_io' 2019-01-26 09:20:44 +01:00
fbtft staging: fbtft: Prefer using the BIT macro 2018-10-03 11:36:08 -07:00
fsl-dpaa2 Staging/IIO patches for 4.20-rc1 2018-10-29 10:38:10 -07:00
fwserial fwserial: switch to ->[sg]et_serial() 2018-09-14 11:19:47 -04:00
gasket staging: gasket: Fix sparse "incorrect type in assignment" warnings. 2018-10-19 21:12:29 +02:00
gdm724x staging: gdm724x: redundant variables idProduct and idVendor 2018-07-11 13:12:34 +02:00
goldfish staging: goldfish: add a blank line into struct goldfish_audio 2018-07-12 21:49:24 +02:00
greybus Staging/IIO patches for 4.20-rc1 2018-10-29 10:38:10 -07:00
gs_fpgaboot Staging: gs_fpgaboot: remove FSF's mailing address from io.h 2018-01-08 16:47:23 +01:00
iio Staging/IIO patches for 4.20-rc1 2018-10-29 10:38:10 -07:00
ks7010 staging: ks7010: Remove extra blank line 2018-10-19 21:10:45 +02:00
media media fixes for v4.20-rc7 2018-12-12 18:24:32 -08:00
most staging: most: use format specifier "%s" in snprintf 2018-11-09 04:34:12 -08:00
mt29f_spinand mtd: rawnand: Deprecate ->{set,get}_features() hooks 2018-10-03 11:12:25 +02:00
mt7621-dma staging: mt7621-dma: fix potentially dereferencing uninitialized 'tx_desc' 2018-11-07 13:08:28 +01:00
mt7621-dts staging: mt7621-dts: add pcie controller port registers 2018-08-08 14:08:41 +02:00
mt7621-eth Staging/IIO patches for 4.20-rc1 2018-10-29 10:38:10 -07:00
mt7621-mmc staging: mt7621-mmc: Use BIT macro instead of explicit shifting in dbg.h 2018-10-14 13:30:34 +02:00
mt7621-pci staging: mt7621-pci: Prefer using the BIT macro 2018-10-09 14:59:39 +02:00
mt7621-pinctrl staging: mt7621-pinctrl: fix uninitialized variable ngroups 2018-11-11 11:47:38 -08:00
mt7621-spi staging: mt7621-spi: Remove unnecessary braces {} from single statement if block. 2018-06-17 09:05:12 +02:00
netlogic net: Add generic ndo_select_queue functions 2018-07-09 13:15:34 -07:00
nvec Revert "staging: nvec: Augment TODO file with GPIO work item" 2018-04-23 18:49:51 +02:00
octeon staging: octeon: remove redundant license text 2018-01-15 16:03:45 +01:00
octeon-usb staging: octeon-hcd: remove unnecessary unlikely() 2018-09-14 15:21:06 +02:00
olpc_dcon staging: olpc_dcon: add a missing dependency 2018-09-20 12:28:02 +02:00
pi433 staging: pi433: eliminate a temporary variable 2018-08-27 12:07:56 +02:00
rtl8188eu staging: rtl8188eu: Fix module loading from tasklet for WEP encryption 2019-01-16 22:03:20 +01:00
rtl8192e Staging/IIO patches for 4.20-rc1 2018-10-29 10:38:10 -07:00
rtl8192u Staging/IIO patches for 4.20-rc1 2018-10-29 10:38:10 -07:00
rtl8712 staging: rtl8712: Fix possible buffer overrun 2018-12-05 09:56:09 +01:00
rtl8723bs Revert commit ef9209b642 "staging: rtl8723bs: Fix indenting errors and an off-by-one mistake in core/rtw_mlme_ext.c" 2018-12-05 09:56:09 +01:00
rtlwifi staging: rtlwifi: phydm: fix spelling mistake "Abnrormal" -> "Abnormal" 2018-10-14 13:31:53 +02:00
rts5208 staging: rts5208: Remove unnecessary braces {} 2018-09-25 21:10:36 +02:00
sm750fb staging: sm750fb: Remove space after cast 2018-10-09 14:57:33 +02:00
speakup staging: speakup: Add a pair of braces 2018-10-19 21:10:45 +02:00
unisys treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
vboxvideo Staging/IIO patches for 4.20-rc1 2018-10-29 10:38:10 -07:00
vc04_services staging: bcm2835-audio: double free in init error path 2019-01-09 17:45:54 +01:00
vme staging: vme: vme_user: Fix some error handling paths in 'vme_user_probe()' 2018-03-23 15:55:21 +01:00
vt6655 staging: vt6655: Remove space after cast 2018-10-09 14:59:58 +02:00
vt6656 staging: vt6655: remove some redundant variables 2018-07-11 14:47:08 +02:00
wilc1000 staging: wilc1000: fix missing read_write setting when reading data 2019-01-09 17:45:54 +01:00
wlan-ng staging: wlan-ng: Replace long int with long 2018-10-19 21:10:45 +02:00
xgifb Staging: xgifb: XGI_main_26.c: Refactored the function 2018-03-22 18:29:50 +01:00
Kconfig staging: dgnc: delete the driver 2018-10-02 15:14:14 -07:00
Makefile staging: dgnc: delete the driver 2018-10-02 15:14:14 -07:00