From patchwork Tue Feb 2 13:37:41 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 375188 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, URIBL_RED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EACE4C433E0 for ; Tue, 2 Feb 2021 19:27:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9FF8164E4D for ; Tue, 2 Feb 2021 19:27:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233392AbhBBT13 (ORCPT ); Tue, 2 Feb 2021 14:27:29 -0500 Received: from mail.kernel.org ([198.145.29.99]:45374 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233526AbhBBN67 (ORCPT ); Tue, 2 Feb 2021 08:58:59 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id A7DB864FF3; Tue, 2 Feb 2021 13:46:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1612273576; bh=w2Mhr1+ky3Xvd8O+nwqMTrZvWrIJK5OnoWJO9/Dw+Mw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=t1oQR3HctJuj02i7HzwAit+FBgUt93iCuCQDUutyPrgFs8jbLrUNNS304BBrosUKu DTDF1UrWSSnJ0csUtcoInFzW+QkeIcG22iEjQA+v2A2Fcv+LD+HwFq+MVZAOltgB5r jt3eA/9nwLirpUVNAPva/jnBrpYx4aLOS8BdWmt4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josef Bacik , Jens Axboe Subject: [PATCH 5.4 03/61] nbd: freeze the queue while were adding connections Date: Tue, 2 Feb 2021 14:37:41 +0100 Message-Id: <20210202132946.628048427@linuxfoundation.org> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210202132946.480479453@linuxfoundation.org> References: <20210202132946.480479453@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Josef Bacik commit b98e762e3d71e893b221f871825dc64694cfb258 upstream. When setting up a device, we can krealloc the config->socks array to add new sockets to the configuration. However if we happen to get a IO request in at this point even though we aren't setup we could hit a UAF, as we deref config->socks without any locking, assuming that the configuration was setup already and that ->socks is safe to access it as we have a reference on the configuration. But there's nothing really preventing IO from occurring at this point of the device setup, we don't want to incur the overhead of a lock to access ->socks when it will never change while the device is running. To fix this UAF scenario simply freeze the queue if we are adding sockets. This will protect us from this particular case without adding any additional overhead for the normal running case. Cc: stable@vger.kernel.org Signed-off-by: Josef Bacik Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- drivers/block/nbd.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1014,6 +1014,12 @@ static int nbd_add_socket(struct nbd_dev if (!sock) return err; + /* + * We need to make sure we don't get any errant requests while we're + * reallocating the ->socks array. + */ + blk_mq_freeze_queue(nbd->disk->queue); + if (!netlink && !nbd->task_setup && !test_bit(NBD_RT_BOUND, &config->runtime_flags)) nbd->task_setup = current; @@ -1052,10 +1058,12 @@ static int nbd_add_socket(struct nbd_dev nsock->cookie = 0; socks[config->num_connections++] = nsock; atomic_inc(&config->live_connections); + blk_mq_unfreeze_queue(nbd->disk->queue); return 0; put_socket: + blk_mq_unfreeze_queue(nbd->disk->queue); sockfd_put(sock); return err; }