Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-10 22:21:40 +00:00
Code Issues Packages Projects Releases Wiki Activity
b85ea95d08
linux/drivers/mtd/ubi
History
ZhaoLong Wang d07cec9c23 ubi: block: Fix use-after-free in ubiblock_cleanup 
The following BUG is reported when a ubiblock is removed:

 ==================================================================
 BUG: KASAN: slab-use-after-free in ubiblock_cleanup+0x88/0xa0 [ubi]
 Read of size 4 at addr ffff88810c8f3804 by task ubiblock/1716

 CPU: 5 PID: 1716 Comm: ubiblock Not tainted 6.6.0-rc2+ #135
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
 Call Trace:
  <TASK>
  dump_stack_lvl+0x37/0x50
  print_report+0xd0/0x620
  kasan_report+0xb6/0xf0
  ubiblock_cleanup+0x88/0xa0 [ubi]
  ubiblock_remove+0x121/0x190 [ubi]
  vol_cdev_ioctl+0x355/0x630 [ubi]
  __x64_sys_ioctl+0xc7/0x100
  do_syscall_64+0x3f/0x90
  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
 RIP: 0033:0x7f08d7445577
 Code: b3 66 90 48 8b 05 11 89 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 8
 RSP: 002b:00007ffde05a3018 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
 RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f08d7445577
 RDX: 0000000000000000 RSI: 0000000000004f08 RDI: 0000000000000003
 RBP: 0000000000816010 R08: 00000000008163a7 R09: 0000000000000000
 R10: 0000000000000003 R11: 0000000000000206 R12: 0000000000000003
 R13: 00007ffde05a3130 R14: 0000000000000000 R15: 0000000000000000
  </TASK>

 Allocated by task 1715:
  kasan_save_stack+0x22/0x50
  kasan_set_track+0x25/0x30
  __kasan_kmalloc+0x7f/0x90
  __alloc_disk_node+0x40/0x2b0
  __blk_mq_alloc_disk+0x3e/0xb0
  ubiblock_create+0x2ba/0x620 [ubi]
  vol_cdev_ioctl+0x581/0x630 [ubi]
  __x64_sys_ioctl+0xc7/0x100
  do_syscall_64+0x3f/0x90
  entry_SYSCALL_64_after_hwframe+0x6e/0xd8

 Freed by task 0:
  kasan_save_stack+0x22/0x50
  kasan_set_track+0x25/0x30
  kasan_save_free_info+0x2b/0x50
  __kasan_slab_free+0x10e/0x190
  __kmem_cache_free+0x96/0x220
  bdev_free_inode+0xa4/0xf0
  rcu_core+0x496/0xec0
  __do_softirq+0xeb/0x384

 The buggy address belongs to the object at ffff88810c8f3800
  which belongs to the cache kmalloc-1k of size 1024
 The buggy address is located 4 bytes inside of
  freed 1024-byte region [ffff88810c8f3800, ffff88810c8f3c00)

 The buggy address belongs to the physical page:
 page:00000000d03de848 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c8f0
 head:00000000d03de848 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
 flags: 0x200000000000840(slab|head|node=0|zone=2)
 page_type: 0xffffffff()
 raw: 0200000000000840 ffff888100042dc0 ffffea0004244400 dead000000000002
 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
  ffff88810c8f3700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffff88810c8f3780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 >ffff88810c8f3800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                    ^
  ffff88810c8f3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff88810c8f3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ==================================================================

Fix it by using a local variable to record the gendisk ID.

Fixes: 77567b25ab ("ubi: use blk_mq_alloc_disk and blk_cleanup_disk")
Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
2023-10-28 23:18:39 +02:00
..
attach.c mtd: Convert fallthrough comments into statements 2020-03-30 10:14:54 +02:00
block.c ubi: block: Fix use-after-free in ubiblock_cleanup 2023-10-28 23:18:39 +02:00
build.c ubi: fastmap: Add module parameter to control reserving filling pool PEBs 2023-10-28 23:15:44 +02:00
cdev.c ubi: fastmap: Add control in 'UBI_IOCATT' ioctl to reserve PEBs for filling pools 2023-10-28 23:16:00 +02:00
debug.c ubi: Fix permission display of the debugfs files 2023-02-02 21:13:45 +01:00
debug.h treewide: use get_random_u32_below() instead of deprecated function 2022-11-18 02:15:15 +01:00
eba.c ubi: fastmap: Wait until there are enough free PEBs before filling pools 2023-10-28 22:43:40 +02:00
fastmap-wl.c ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs 2023-10-28 23:14:55 +02:00
fastmap.c ubi: fastmap: Wait until there are enough free PEBs before filling pools 2023-10-28 22:43:40 +02:00
gluebi.c mtd: ubi: gluebi: Fix misnamed function parameter documentation 2020-11-20 12:37:32 +01:00
io.c ubi: Fix repeated words in comments 2022-09-21 11:32:27 +02:00
kapi.c mtd: ubi: block: wire-up device parent 2023-02-13 22:24:10 +01:00
Kconfig
Makefile
misc.c ubi: use correct names in function kernel-doc comments 2023-02-05 22:36:39 +01:00
ubi-media.h ubi: ubi-media.h: Fix comment typo 2022-09-21 11:12:18 +02:00
ubi.h ubi: fastmap: Add module parameter to control reserving filling pool PEBs 2023-10-28 23:15:44 +02:00
upd.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
vmt.c ubi: Fix possible null-ptr-deref in ubi_free_volume() 2023-02-02 21:13:44 +01:00
vtbl.c ubi: Free the normal volumes in error paths of ubi_attach_mtd_dev() 2020-01-16 23:35:59 +01:00
wl.c ubi: fastmap: Get wl PEB even ec beyonds the 'max' if free PEBs are run out 2023-10-28 23:07:54 +02:00
wl.h ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs 2023-10-28 23:14:55 +02:00