From patchwork Thu Jul 22 04:02:16 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Leizhen \(ThunderTown\)" X-Patchwork-Id: 483861 Delivered-To: patch@linaro.org Received: by 2002:a02:c94a:0:0:0:0:0 with SMTP id u10csp8250jao; Wed, 21 Jul 2021 21:03:56 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyQe4a90tu1KioKHwhFvn3NOzFILkFZ4SqzxDkF6Z3sIzMHzihAI7QVSPpC93zjuPSTO7dH X-Received: by 2002:a92:2a10:: with SMTP id r16mr25437566ile.223.1626926636591; Wed, 21 Jul 2021 21:03:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1626926636; cv=none; d=google.com; s=arc-20160816; b=I4fglEb8zPtH/5v+lSan1nO3Nm8mokNkrXEyIezxzy3gBlwvEQGFt/rAvOWgfyoYSk 5ZARf7+rgeQPkN9dJ6M/Rp3RhKqglm0T1sxZTnYSQNkUI6/Gyq56O2NM8nR+skPt720o CRDzN4XK4IGZm0mhVt1KRJXXIF4MkoGyK2UaVlpasmTcNcs4Xh+QnPLwj3v2wsY0Qyiy 3yiXRLdpUxYtZNS0o5Ix8K2Lzhamtx7EIVR/1tvDw15ojE+KtQh6fu8puG80vLC06YpJ 1RXMJNAjDHpCLxaNoXLnH9j/p+gcRFWxIy5qeer0tRrN16L8dIMwbdWY3pXMPOaRY4Pt WgGQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=93aHDfD6yrpltV3i1KQKH/95mErHOvy8ju06mgR5dEA=; b=e+d5OCn74TZEKMbuH/QdhhVMgJ45wrEZN92+ibSSUem/fsAnPnbvZjGG8G2l6X9MZh Y5uqT+6eNm+3W5EFluu9pXmnmMbAcjH/OSMmJ6r92fyqYH3zYemzzyd7ly3fdpc4j+x0 0JE2vaAAF+I6vg+NDTjYJc9lrzHuAPjzhzxXWu1rmBCb7dwr4+7fTBJqCJjDPt8zcla/ BRoJ7gtKUsg7m8D5QqiddrRFzbmaSUlYQbLFGofcwAprhur9d+IeNotCwOOs0d1HuyAs UJ9QHbK+EWutQwBgPT6+cZA5QbQBZCPF+m67wJjJ9ml5LGRtKuuGCJQ/1ZRQF4lVvoiE NmmA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ceph-devel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=ceph-devel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=huawei.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id v14si27847458ilj.0.2021.07.21.21.03.56; Wed, 21 Jul 2021 21:03:56 -0700 (PDT) Received-SPF: pass (google.com: domain of ceph-devel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ceph-devel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=ceph-devel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231293AbhGVDXP (ORCPT + 1 other); Wed, 21 Jul 2021 23:23:15 -0400 Received: from szxga02-in.huawei.com ([45.249.212.188]:11462 "EHLO szxga02-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231238AbhGVDWl (ORCPT ); Wed, 21 Jul 2021 23:22:41 -0400 Received: from dggemv711-chm.china.huawei.com (unknown [172.30.72.54]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4GVdxz559Jzch9T; Thu, 22 Jul 2021 11:59:51 +0800 (CST) Received: from dggpemm500006.china.huawei.com (7.185.36.236) by dggemv711-chm.china.huawei.com (10.1.198.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Thu, 22 Jul 2021 12:03:15 +0800 Received: from thunder-town.china.huawei.com (10.174.179.0) by dggpemm500006.china.huawei.com (7.185.36.236) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Thu, 22 Jul 2021 12:03:14 +0800 From: Zhen Lei To: Ilya Dryomov , Dongsheng Yang , Jens Axboe , Yehuda Sadeh , Sage Weil , ceph-devel , linux-block , linux-kernel CC: Zhen Lei Subject: [PATCH] rbd: use kref_put_lock() to fix potential UAF Date: Thu, 22 Jul 2021 12:02:16 +0800 Message-ID: <20210722040216.4090-1-thunder.leizhen@huawei.com> X-Mailer: git-send-email 2.26.0.windows.1 MIME-Version: 1.0 X-Originating-IP: [10.174.179.0] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To dggpemm500006.china.huawei.com (7.185.36.236) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: ceph-devel@vger.kernel.org When the refcount is decreased to 0, the rbd_client_release() is called. Before CPU0 reaches the race point (1), CPU1 may obtain the spinlock and traverse the linked list to find 'rbdc'. Although CPU1 will call kref_get() to increase the refcount, it is obviously too late. CPU0 will release 'rbdc' directly, CPU1 then accesses 'rbdc' and triggers UAF. Use kref_put_lock() to ensure that both the operations of decrease refcount to 0 and link deletion are lock protected eliminates this risk. CPU0 CPU1 rbd_client_release(): <-------- (1) spin_lock(&rbd_client_list_lock); list_del(&rbdc->node); spin_unlock(&rbd_client_list_lock); kfree(rbdc); <-------- use-after-free Fixes: 602adf400201 ("rbd: introduce rados block device (rbd), based on libceph") Signed-off-by: Zhen Lei --- drivers/block/rbd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) -- 2.25.1 diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c index 531d390902dd..3a8989bf8e9c 100644 --- a/drivers/block/rbd.c +++ b/drivers/block/rbd.c @@ -875,11 +875,11 @@ static void rbd_client_release(struct kref *kref) { struct rbd_client *rbdc = container_of(kref, struct rbd_client, kref); - dout("%s: rbdc %p\n", __func__, rbdc); - spin_lock(&rbd_client_list_lock); list_del(&rbdc->node); spin_unlock(&rbd_client_list_lock); + dout("%s: rbdc %p\n", __func__, rbdc); + ceph_destroy_client(rbdc->client); kfree(rbdc); } @@ -891,7 +891,8 @@ static void rbd_client_release(struct kref *kref) static void rbd_put_client(struct rbd_client *rbdc) { if (rbdc) - kref_put(&rbdc->kref, rbd_client_release); + kref_put_lock(&rbdc->kref, + rbd_client_release, &rbd_client_list_lock); } /*