[5.10,237/289] nbd: Fix NULL pointer in flush_workqueue

From: Sun Ke <sunke32@huawei.com>

From: Sun Ke <sunke32@huawei.com>

[ Upstream commit 79ebe9110fa458d58f1fceb078e2068d7ad37390 ]

Open /dev/nbdX first, the config_refs will be 1 and
the pointers in nbd_device are still null. Disconnect
/dev/nbdX, then reference a null recv_workq. The
protection by config_refs in nbd_genl_disconnect is useless.

[  656.366194] BUG: kernel NULL pointer dereference, address: 0000000000000020
[  656.368943] #PF: supervisor write access in kernel mode
[  656.369844] #PF: error_code(0x0002) - not-present page
[  656.370717] PGD 10cc87067 P4D 10cc87067 PUD 1074b4067 PMD 0
[  656.371693] Oops: 0002 [#1] SMP
[  656.372242] CPU: 5 PID: 7977 Comm: nbd-client Not tainted 5.11.0-rc5-00040-g76c057c84d28 #1
[  656.373661] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
[  656.375904] RIP: 0010:mutex_lock+0x29/0x60
[  656.376627] Code: 00 0f 1f 44 00 00 55 48 89 fd 48 83 05 6f d7 fe 08 01 e8 7a c3 ff ff 48 83 05 6a d7 fe 08 01 31 c0 65 48 8b 14 25 00 6d 01 00 <f0> 48 0f b1 55 d
[  656.378934] RSP: 0018:ffffc900005eb9b0 EFLAGS: 00010246
[  656.379350] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[  656.379915] RDX: ffff888104cf2600 RSI: ffffffffaae8f452 RDI: 0000000000000020
[  656.380473] RBP: 0000000000000020 R08: 0000000000000000 R09: ffff88813bd6b318
[  656.381039] R10: 00000000000000c7 R11: fefefefefefefeff R12: ffff888102710b40
[  656.381599] R13: ffffc900005eb9e0 R14: ffffffffb2930680 R15: ffff88810770ef00
[  656.382166] FS:  00007fdf117ebb40(0000) GS:ffff88813bd40000(0000) knlGS:0000000000000000
[  656.382806] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  656.383261] CR2: 0000000000000020 CR3: 0000000100c84000 CR4: 00000000000006e0
[  656.383819] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  656.384370] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  656.384927] Call Trace:
[  656.385111]  flush_workqueue+0x92/0x6c0
[  656.385395]  nbd_disconnect_and_put+0x81/0xd0
[  656.385716]  nbd_genl_disconnect+0x125/0x2a0
[  656.386034]  genl_family_rcv_msg_doit.isra.0+0x102/0x1b0
[  656.386422]  genl_rcv_msg+0xfc/0x2b0
[  656.386685]  ? nbd_ioctl+0x490/0x490
[  656.386954]  ? genl_family_rcv_msg_doit.isra.0+0x1b0/0x1b0
[  656.387354]  netlink_rcv_skb+0x62/0x180
[  656.387638]  genl_rcv+0x34/0x60
[  656.387874]  netlink_unicast+0x26d/0x590
[  656.388162]  netlink_sendmsg+0x398/0x6c0
[  656.388451]  ? netlink_rcv_skb+0x180/0x180
[  656.388750]  ____sys_sendmsg+0x1da/0x320
[  656.389038]  ? ____sys_recvmsg+0x130/0x220
[  656.389334]  ___sys_sendmsg+0x8e/0xf0
[  656.389605]  ? ___sys_recvmsg+0xa2/0xf0
[  656.389889]  ? handle_mm_fault+0x1671/0x21d0
[  656.390201]  __sys_sendmsg+0x6d/0xe0
[  656.390464]  __x64_sys_sendmsg+0x23/0x30
[  656.390751]  do_syscall_64+0x45/0x70
[  656.391017]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

To fix it, just add if (nbd->recv_workq) to nbd_disconnect_and_put().

Fixes: e9e006f5fcf2 ("nbd: fix max number of supported devs")
Signed-off-by: Sun Ke <sunke32@huawei.com>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Link: https://lore.kernel.org/r/20210512114331.1233964-2-sunke32@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/nbd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Message ID	20210517140313.149833914@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Sun Ke <sunke32@huawei.com>, Josef Bacik <josef@toxicpanda.com>, Jens Axboe <axboe@kernel.dk>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 237/289] nbd: Fix NULL pointer in flush_workqueue Date: Mon, 17 May 2021 16:02:42 +0200 Message-Id: <20210517140313.149833914@linuxfoundation.org> In-Reply-To: <20210517140305.140529752@linuxfoundation.org> References: <20210517140305.140529752@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/289] tpm: fix error return code in tpm2_get_cc_attrs_tbl() [5.10,003/289] tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt() [5.10,005/289] KVM: x86/mmu: Remove the defunct update_pte() paging hook [5.10,006/289] KVM/VMX: Invoke NMI non-IST entry instead of IST entry [5.10,007/289] ACPI: PM: Add ACPI ID of Alder Lake Fan [5.10,008/289] PM: runtime: Fix unpaired parent child_count for force_resume [5.10,010/289] kvm: Cap halt polling at kvm->max_halt_poll_ns [5.10,011/289] ath11k: fix thermal temperature read [5.10,012/289] fs: dlm: fix debugfs dump [5.10,013/289] fs: dlm: add errno handling to check callback [5.10,015/289] fs: dlm: flush swork on shutdown [5.10,017/289] ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF [5.10,022/289] i2c: bail out early when RDWR parameters are wrong [5.10,028/289] Bluetooth: initialize skb_queue_head at l2cap_chan_create() [5.10,029/289] net/sched: cls_flower: use ntohs for struct flow_dissector_key_ports [5.10,030/289] net: bridge: when suppression is enabled exclude RARP packets [5.10,031/289] Bluetooth: check for zapped sk before connecting [5.10,034/289] net: hns3: remediate a potential overflow risk of bd_num_list [5.10,036/289] ip6_vti: proper dev_{hold\|put} in ndo_[un]init methods [5.10,037/289] ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet [5.10,040/289] ASoC: rt5670: Add a quirk for the Dell Venue 10 Pro 5055 [5.10,041/289] i2c: Add I2C_AQ_NO_REP_START adapter quirk [5.10,043/289] coresight: Do not scan for graph if none is present [5.10,044/289] IB/hfi1: Correct oversized ring allocation [5.10,046/289] pinctrl: samsung: use int for register masks in Exynos [5.10,049/289] mt76: mt76x0: disable GTK offloading [5.10,051/289] fuse: invalidate attrs when page writeback completes [5.10,053/289] cuse: prevent clone [5.10,054/289] iwlwifi: pcie: make cfg vs. trans_cfg more robust [5.10,055/289] powerpc/mm: Add cond_resched() while removing hpte mappings [5.10,056/289] ASoC: rsnd: call rsnd_ssi_master_clk_start() from rsnd_ssi_init() [5.10,057/289] Revert "iommu/amd: Fix performance counter initialization" [5.10,060/289] selftests: Set CC to clang in lib.mk if LLVM is set [5.10,065/289] sctp: Fix out-of-bounds warning in sctp_process_asconf_param() [5.10,066/289] flow_dissector: Fix out-of-bounds warning in __skb_flow_bpf_to_target() [5.10,067/289] powerpc/smp: Set numa node before updating mask [5.10,070/289] net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule [5.10,073/289] drm/amd/display: fixed divide by zero kernel crash during dsc enablement [5.10,074/289] drm/amd/display: add handling for hdcp2 rx id list validation [5.10,075/289] drm/amdgpu: Add mem sync flag for IB allocated by SA [5.10,076/289] mt76: mt7615: fix entering driver-own state on mt7663 [5.10,077/289] crypto: ccp: Free SEV device if SEV init fails [5.10,078/289] wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt [5.10,079/289] wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join [5.10,082/289] iavf: remove duplicate free resources calls [5.10,083/289] net: ethernet: mtk_eth_soc: fix RX VLAN offload [5.10,085/289] selftests: mlxsw: Fix mausezahn invocation in ERSPAN scale test [5.10,086/289] kbuild: generate Module.symvers only when vmlinux exists [5.10,089/289] watchdog: rename __touch_watchdog() to a better descriptive name [5.10,090/289] watchdog: explicitly update timestamp when reporting softlockup [5.10,091/289] watchdog/softlockup: remove logic that tried to prevent repeated reports [5.10,093/289] ASoC: rt286: Make RT286_SET_GPIO_* readable and writable [5.10,096/289] f2fs: fix compat F2FS_IOC_{MOVE,GARBAGE_COLLECT}_RANGE [5.10,098/289] f2fs: fix panic during f2fs_resize_fs() [5.10,101/289] remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader [5.10,103/289] PCI: Release OF node in pci_scan_device()s error path [5.10,104/289] ARM: 9064/1: hw_breakpoint: Do not directly check the events overflow_handler hook [5.10,105/289] f2fs: fix to align to section for fallocate() on pinned file [5.10,110/289] PCI: endpoint: Fix NULL pointer dereference for ->get_features() [5.10,113/289] f2fs: Fix a hungtask problem in atomic write [5.10,114/289] f2fs: fix to avoid accessing invalid fio in f2fs_allocate_data_block() [5.10,119/289] NFS: Deal correctly with attribute generation counter overflow [5.10,120/289] PCI: endpoint: Fix missing destroy_workqueue() [5.10,121/289] pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() [5.10,123/289] SUNRPC: Move fault injection call sites [5.10,126/289] thermal/drivers/tsens: Fix missing put_device error [5.10,128/289] nfsd: ensure new clients break delegations [5.10,131/289] dmaengine: idxd: fix dma device lifetime [5.10,132/289] dmaengine: idxd: fix cdev setup and free device lifetime issues [5.10,133/289] SUNRPC: fix ternary sign expansion bug in tracing [5.10,134/289] pwm: atmel: Fix duty cycle calculation in .get_state() [5.10,137/289] xprtrdma: rpcrdma_mr_pop() already does list_del_init() [5.10,142/289] scsi: ufs: core: Cancel rpm_dev_flush_recheck_work during system suspend [5.10,143/289] scsi: ufs: core: Narrow down fast path in system suspend path [5.10,144/289] rtc: ds1307: Fix wday settings for rx8130 [5.10,145/289] net: hns3: fix incorrect configuration for igu_egu_hw_err [5.10,150/289] net: hns3: disable phy loopback setting in hclge_mac_start_phy [5.10,152/289] RISC-V: Fix error code returned by riscv_hartid_to_cpuid() [5.10,154/289] libbpf: Fix signed overflow in ringbuf_process_ring [5.10,156/289] block/rnbd-clt: Check the return value of the function rtrs_clt_query [5.10,157/289] ethernet:enic: Fix a use after free bug in enic_hard_start_xmit [5.10,162/289] drm/radeon: Fix off-by-one power_state index heap overwrite [5.10,164/289] arm64: entry: factor irq triage logic into macros [5.10,165/289] arm64: entry: always set GIC_PRIO_PSR_I_SET during entry [5.10,167/289] mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts() [5.10,169/289] ksm: fix potential missing rmap_item for stable_node [5.10,171/289] mm/gup: return an error on migration failure [5.10,172/289] mm/gup: check for isolation errors [5.10,175/289] smc: disallow TCP_ULP in smc_setsockopt() [5.10,176/289] netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check [5.10,177/289] netfilter: nftables: Fix a memleak from userdata error path in new objects [5.10,178/289] can: mcp251xfd: mcp251xfd_probe(): add missing can_rx_offload_del() in error path [5.10,183/289] fs/proc/generic.c: fix incorrect pde_is_permanent check [5.10,188/289] i40e: fix broken XDP support [5.10,191/289] i40e: Fix PHY type identifiers for 2.5G and 5G adapters [5.10,193/289] f2fs: avoid unneeded data copy in f2fs_ioc_move_range() [5.10,194/289] ARC: entry: fix off-by-one error in syscall number validation [5.10,198/289] powerpc/64s: Fix crashes when toggling entry flush barrier [5.10,206/289] arm64: Fix race condition on PG_dcache_clean in __sync_icache_dcache() [5.10,208/289] drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are conn... [5.10,209/289] drm/amd/display: Initialize attribute for hdcp_srm sysfs file [5.10,210/289] drm/i915: Avoid div-by-zero on gen2 [5.10,213/289] drm/msm/dp: initialize audio_comp when audio starts [5.10,214/289] KVM: x86: Cancel pvclock_gtod_work on module removal [5.10,215/289] KVM: x86: Prevent deadlock against tk_core.seq [5.10,216/289] dax: Add an enum for specifying dax wakup mode [5.10,218/289] dax: Wake up all waiters after invalidating dax entry [5.10,220/289] xen/unpopulated-alloc: fix error return code in fill_list() [5.10,222/289] usb: dwc3: gadget: Free gadget structure only after freeing endpoints [5.10,223/289] iio: light: gp2ap002: Fix rumtime PM imbalance on error [5.10,226/289] usb: fotg210-hcd: Fix an error message [5.10,227/289] hwmon: (occ) Fix poll rate limiting [5.10,229/289] ACPI: scan: Fix a memory leak in an error handling path [5.10,231/289] nvmet: add lba to sect conversion helpers [5.10,233/289] nvmet-rdma: Fix NULL deref when SEND is completed with error [5.10,234/289] f2fs: compress: fix to free compress page correctly [5.10,237/289] nbd: Fix NULL pointer in flush_workqueue [5.10,239/289] blk-mq: Swap two calls in blk_mq_exit_queue() [5.10,240/289] usb: dwc3: omap: improve extcon initialization [5.10,242/289] usb: xhci: Increase timeout for HC halt [5.10,244/289] usb: core: hub: fix race condition about TRSMRCY of resume [5.10,245/289] usb: dwc3: gadget: Enable suspend events [5.10,248/289] usb: typec: ucsi: Put fwnode in any case during ->probe() [5.10,249/289] xhci-pci: Allow host runtime PM as default for Intel Alder Lake xHCI [5.10,251/289] xhci: Add reset resume quirk for AMD xhci controller. [5.10,256/289] KVM: x86: Emulate RDPID only if RDTSCP is supported [5.10,259/289] KVM: VMX: Do not advertise RDPID if ENABLE_RDTSCP control is unsupported [5.10,260/289] KVM: VMX: Disable preemption when probing user return MSRs [5.10,264/289] iommu/vt-d: Remove WO permissions on second-level paging entries [5.10,266/289] MIPS: Reinstate platform `__div64_32 handler [5.10,269/289] clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap issue [5.10,271/289] ARM: 9011/1: centralize phys-to-virt conversion of DT/ATAGS address [5.10,272/289] ARM: 9012/1: move device tree mapping out of linear region [5.10,274/289] ARM: 9027/1: head.S: explicitly map DT even if it lives in the first physical section [5.10,276/289] kobject_uevent: remove warning in init_uevent_argv() [5.10,277/289] drm/i915/gt: Fix a double free in gen8_preallocate_top_level_pdp [5.10,280/289] drm/i915: Fix crash in auto_retire [5.10,281/289] clk: exynos7: Mark aclk_fsys1_200 as critical [5.10,285/289] dt-bindings: serial: 8250: Remove duplicated compatible strings [5.10,286/289] debugfs: Make debugfs_allow RO after init [5.10,287/289] ext4: fix debug format string warning [5.10,289/289] ASoC: rsnd: check all BUSIF status when error

[5.10,237/289] nbd: Fix NULL pointer in flush_workqueue

Commit Message

Patch