From patchwork Thu Oct 20 13:20:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu Kuai X-Patchwork-Id: 6187 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4242:0:0:0:0:0 with SMTP id s2csp99838wrr; Thu, 20 Oct 2022 06:07:28 -0700 (PDT) X-Google-Smtp-Source: AMsMyM7gARHofj7jCt8CpjzToo3o4Cvhi1hLsfd6EcG5WjyzW1/2FXH+FOTW0w279DNykrTWG+F9 X-Received: by 2002:a17:906:4fcf:b0:790:584:88ae with SMTP id i15-20020a1709064fcf00b00790058488aemr10432640ejw.212.1666271247924; Thu, 20 Oct 2022 06:07:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666271247; cv=none; d=google.com; s=arc-20160816; b=Ad5SEHIcm0PRbWlAnXbHPC43HZ4gaWbO5HalEqIcW0+rNnh52aplNIZQE03NoXfWPx cL3EymFZ2uQZMIebzVlBlqb+SJf3jvf5JSm1QJ1XMGBcCMWVdcPdiJRteewx6TeExanS T8pDxp5efsBwwEJIETi+hS0HI2gsAkKqmcTRfkpkvNihDgYbqc7Z9r4NxppixIWUvmNG 2SkxJwLqPJEmHuO1DJqQvUc2wBiY3/HEbJNZGoUxngRpjX9YwUDdPZMMwhF3HrxgeOOM ONZLTjQSWH77aWnHAW+5mRH2mr6DZmrZnz7aXxs5o6q1uhA0TknUrK+ZFrVv9S4hsLh0 GmYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=ny5v47rURVfceR0l7c2s+8fANGf7HYbXciUpTdjLOmk=; b=bxfQOtJieT9lMNjO3+1kcaNj2NAQHhHaLPIm/KAHYAMOQjUZdP+6CF+GZZXopn4YNj 9w+Ij8C0nKLv2QsbhIIY/o2bkgDIvMNUBSXq+B/DQ9/5gkEC7+RjYuPMHAKAthDNwLi2 lTdsyu2YDtSx/b/0nti3ajwWUvXwXcsQdlx08GItHlfMNrB+R3iJJDa0bw6ytCDsqzCF 9DNdPGPLyPUJRErAIN3b5VP96Xtlh3nvVbP2BDihCrWiHjBmvxGzYfdJ9+O3SGim6/kU Lps4eTJZ81QMnes8+0XOyqA/TPshyfuPQIzrr2ojpVliMoyJpqVxbjo2A3xzGLuV2Fv/ Nvsw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id r1-20020a056402034100b0045c83d82699si14179057edw.153.2022.10.20.06.06.56; Thu, 20 Oct 2022 06:07:27 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230280AbiJTM67 (ORCPT + 99 others); Thu, 20 Oct 2022 08:58:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52376 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229679AbiJTM64 (ORCPT ); Thu, 20 Oct 2022 08:58:56 -0400 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 253521CCCC2; Thu, 20 Oct 2022 05:58:53 -0700 (PDT) Received: from dggemv704-chm.china.huawei.com (unknown [172.30.72.53]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4MtSMl4CnJzHv5y; Thu, 20 Oct 2022 20:58:43 +0800 (CST) Received: from kwepemm600009.china.huawei.com (7.193.23.164) by dggemv704-chm.china.huawei.com (10.3.19.47) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Thu, 20 Oct 2022 20:58:49 +0800 Received: from huawei.com (10.175.127.227) by kwepemm600009.china.huawei.com (7.193.23.164) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Thu, 20 Oct 2022 20:58:48 +0800 From: Yu Kuai To: , , , , , , , CC: , , , Subject: [PATCH -nect RFC v2 1/2] block: add helpers for bd_holder_dir refcount management Date: Thu, 20 Oct 2022 21:20:48 +0800 Message-ID: <20221020132049.3947415-2-yukuai3@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221020132049.3947415-1-yukuai3@huawei.com> References: <20221020132049.3947415-1-yukuai3@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.175.127.227] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To kwepemm600009.china.huawei.com (7.193.23.164) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747212040329873403?= X-GMAIL-MSGID: =?utf-8?q?1747212040329873403?= Currently the lifecycle of bd_holder_dir is problematic, it can be freed in del_gendisk() while it can still be accessed before disk_release(). And there in no way to know if the kobject if freed by kobject_put() for now, thus add a new field in bloce_device to manage refcount of bd_holder_dir seperately. Prepare to fix the problem in following patch. Signed-off-by: Yu Kuai --- block/blk.h | 3 +++ block/genhd.c | 27 +++++++++++++++++++++++++++ include/linux/blk_types.h | 1 + 3 files changed, 31 insertions(+) diff --git a/block/blk.h b/block/blk.h index d6ea0d1a6db0..fef868b4169c 100644 --- a/block/blk.h +++ b/block/blk.h @@ -458,6 +458,9 @@ extern const struct address_space_operations def_blk_aops; int disk_register_independent_access_ranges(struct gendisk *disk); void disk_unregister_independent_access_ranges(struct gendisk *disk); +bool bd_try_get_holder_dir(struct block_device *bdev); +void bd_put_holder_dir(struct block_device *bdev); + #ifdef CONFIG_FAIL_MAKE_REQUEST bool should_fail_request(struct block_device *part, unsigned int bytes); #else /* CONFIG_FAIL_MAKE_REQUEST */ diff --git a/block/genhd.c b/block/genhd.c index 17b33c62423d..53f9c8b2690a 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -375,6 +375,33 @@ int disk_scan_partitions(struct gendisk *disk, fmode_t mode) return 0; } +bool bd_try_get_holder_dir(struct block_device *bdev) +{ + mutex_lock(&bdev->bd_disk->open_mutex); + if (!bdev->holder_dir_ref) { + mutex_unlock(&bdev->bd_disk->open_mutex); + return false; + } + + bdev->holder_dir_ref++; + mutex_unlock(&bdev->bd_disk->open_mutex); + return true; +} + +void bd_put_holder_dir(struct block_device *bdev) +{ + mutex_lock(&bdev->bd_disk->open_mutex); + if (WARN_ON(bdev->holder_dir_ref <= 0)) + goto out; + + if (!(--bdev->holder_dir_ref)) { + kobject_put(bdev->bd_holder_dir); + bdev->bd_holder_dir = NULL; + } +out: + mutex_unlock(&bdev->bd_disk->open_mutex); +} + /** * device_add_disk - add disk information to kernel list * @parent: parent device for the disk diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h index e0b098089ef2..550c8e15af49 100644 --- a/include/linux/blk_types.h +++ b/include/linux/blk_types.h @@ -53,6 +53,7 @@ struct block_device { int bd_holders; bool bd_write_holder; struct kobject *bd_holder_dir; + int holder_dir_ref; u8 bd_partno; spinlock_t bd_size_lock; /* for bd_inode->i_size updates */ struct gendisk * bd_disk; From patchwork Thu Oct 20 13:20:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu Kuai X-Patchwork-Id: 6188 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4242:0:0:0:0:0 with SMTP id s2csp99855wrr; Thu, 20 Oct 2022 06:07:30 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4fSbCR+HHg6nBzEU8gFzpsDrIrXVoLLNrIGvChjvetylP070Y+jege95/00AjN7vRSa89O X-Received: by 2002:a17:902:f541:b0:186:4b91:4501 with SMTP id h1-20020a170902f54100b001864b914501mr13858277plf.171.1666271250447; Thu, 20 Oct 2022 06:07:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666271250; cv=none; d=google.com; s=arc-20160816; b=Z6k8feWkYZgvPCmun6Ri39av7TDqsX11Sv3vsJ26VA21mENcTdbqHbJUNo48A43xjK erQnv6iV7BCNaklKTY6ZBbtmEHiVXVkdrpEZ0KEqnU2CyIpuoPQ6o+pcLWebmsP+NqXr Vr0X0brIbRrx00jaS3bY16oPPDW898+xNlRpcghC3N2UpNRbCXjnukUvH53UeLq0s+sY sM9CZgcFokJqWcE7BoxzVtATJYWkhmrFfvzJrxOWSeDv1aELhS/UqMOrneQ4iFCA510n pCQ4U9gGaOVyZh7Z0GjNuD2PJGfO5vfZVk6MskMwSe5nQR0z10d915zYA9d6VSwebTyS W5Uw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=vdEHqy/7g/Xzw7lvlwYpudeyCIss3EGR5qeyFstEMyo=; b=feAqgFe4VtO4s5Y5VnHg/UM6HJ3Qb7ZpO3SKdEJGDF68g7GIZhBb/HWVyBYRFRbRSz ONgksT6Km3PPfL3jgZj3/8afg4MGfP0joWMCzJ7YG3TivWeD/LGN2enaRZTQ/qjkecz9 d0reGyBVUo4FBbF6RohBZEWCiAasvM/ogOPAQy1FXDMUb7q3RrnAGzoGVHY/O8ZwT35s bdfM7XZ/xmvpoX9SPGkENDnjpqxP3blmrB30SCp374McmwxvQkTAG3oTpQ9b36YEHzuQ VPlcUZsFPvnxiZBvtXqLxpF/plRP97ZleEbtWyRLASGgMOKruzuBMKjFPIqn8oDC3GV3 abFg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id e16-20020a170902ef5000b00176e05275d1si21579802plx.423.2022.10.20.06.07.04; Thu, 20 Oct 2022 06:07:30 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229994AbiJTM7M (ORCPT + 99 others); Thu, 20 Oct 2022 08:59:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230308AbiJTM7B (ORCPT ); Thu, 20 Oct 2022 08:59:01 -0400 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CFC5A127937; Thu, 20 Oct 2022 05:58:57 -0700 (PDT) Received: from dggemv703-chm.china.huawei.com (unknown [172.30.72.53]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4MtSGd0RY8zVj1y; Thu, 20 Oct 2022 20:54:17 +0800 (CST) Received: from kwepemm600009.china.huawei.com (7.193.23.164) by dggemv703-chm.china.huawei.com (10.3.19.46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Thu, 20 Oct 2022 20:58:50 +0800 Received: from huawei.com (10.175.127.227) by kwepemm600009.china.huawei.com (7.193.23.164) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Thu, 20 Oct 2022 20:58:49 +0800 From: Yu Kuai To: , , , , , , , CC: , , , Subject: [PATCH -nect RFC v2 2/2] block: fix uaf for bd_holder_dir Date: Thu, 20 Oct 2022 21:20:49 +0800 Message-ID: <20221020132049.3947415-3-yukuai3@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221020132049.3947415-1-yukuai3@huawei.com> References: <20221020132049.3947415-1-yukuai3@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.175.127.227] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To kwepemm600009.china.huawei.com (7.193.23.164) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747212043079058757?= X-GMAIL-MSGID: =?utf-8?q?1747212043079058757?= Lifecycle of bd_holder_dir is problematic: t1: t2: // get bdev of lower disk blkdev_get_by_dev // remove lower disk del_gendisk // initial reference is released, and // bd_holder_dir can be freed kobject_put // uaf is triggered bd_link_disk_holder Fix the problem by protecting bd_holder_dir by open_mutex. Signed-off-by: Yu Kuai --- block/genhd.c | 6 +++++- block/holder.c | 19 +++++++++++++------ block/partitions/core.c | 5 ++++- 3 files changed, 22 insertions(+), 8 deletions(-) diff --git a/block/genhd.c b/block/genhd.c index 53f9c8b2690a..b3d04e79e854 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -499,6 +499,8 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk, ret = -ENOMEM; goto out_del_integrity; } + disk->part0->holder_dir_ref = 1; + disk->slave_dir = kobject_create_and_add("slaves", &ddev->kobj); if (!disk->slave_dir) { ret = -ENOMEM; @@ -557,6 +559,8 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk, kobject_put(disk->slave_dir); out_put_holder_dir: kobject_put(disk->part0->bd_holder_dir); + disk->part0->bd_holder_dir = NULL; + disk->part0->holder_dir_ref = 0; out_del_integrity: blk_integrity_del(disk); out_del_block_link: @@ -649,7 +653,7 @@ void del_gendisk(struct gendisk *disk) blk_unregister_queue(disk); - kobject_put(disk->part0->bd_holder_dir); + bd_put_holder_dir(disk->part0); kobject_put(disk->slave_dir); part_stat_set_all(disk->part0, 0); diff --git a/block/holder.c b/block/holder.c index 5283bc804cc1..2e28b472ba1a 100644 --- a/block/holder.c +++ b/block/holder.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only #include #include +#include "blk.h" struct bd_holder_disk { struct list_head list; @@ -85,9 +86,19 @@ int bd_link_disk_holder(struct block_device *bdev, struct gendisk *disk) goto out_unlock; } + /* + * del_gendisk drops the initial reference to bd_holder_dir, so we need + * to keep our own here to allow for cleanup past that point. + */ + if (!bd_try_get_holder_dir(bdev)) { + ret = -ENODEV; + goto out_unlock; + } + holder = kzalloc(sizeof(*holder), GFP_KERNEL); if (!holder) { ret = -ENOMEM; + bd_put_holder_dir(bdev); goto out_unlock; } @@ -98,16 +109,12 @@ int bd_link_disk_holder(struct block_device *bdev, struct gendisk *disk) ret = __link_disk_holder(bdev, disk); if (ret) { kfree(holder); + bd_put_holder_dir(bdev); goto out_unlock; } } list_add(&holder->list, &disk->slave_bdevs); - /* - * del_gendisk drops the initial reference to bd_holder_dir, so we need - * to keep our own here to allow for cleanup past that point. - */ - kobject_get(bdev->bd_holder_dir); out_unlock: mutex_unlock(&disk->open_mutex); @@ -141,7 +148,7 @@ void bd_unlink_disk_holder(struct block_device *bdev, struct gendisk *disk) if (!WARN_ON_ONCE(holder == NULL) && !--holder->refcnt) { if (disk->slave_dir) __unlink_disk_holder(bdev, disk); - kobject_put(bdev->bd_holder_dir); + bd_put_holder_dir(bdev); list_del_init(&holder->list); kfree(holder); } diff --git a/block/partitions/core.c b/block/partitions/core.c index b8112f52d388..39a14f7c308e 100644 --- a/block/partitions/core.c +++ b/block/partitions/core.c @@ -279,7 +279,7 @@ static void delete_partition(struct block_device *part) __invalidate_device(part, true); xa_erase(&part->bd_disk->part_tbl, part->bd_partno); - kobject_put(part->bd_holder_dir); + bd_put_holder_dir(part); device_del(&part->bd_device); /* @@ -390,6 +390,7 @@ static struct block_device *add_partition(struct gendisk *disk, int partno, bdev->bd_holder_dir = kobject_create_and_add("holders", &pdev->kobj); if (!bdev->bd_holder_dir) goto out_del; + bdev->holder_dir_ref = 1; dev_set_uevent_suppress(pdev, 0); if (flags & ADDPART_FLAG_WHOLEDISK) { @@ -411,6 +412,8 @@ static struct block_device *add_partition(struct gendisk *disk, int partno, out_del: kobject_put(bdev->bd_holder_dir); + bdev->bd_holder_dir = NULL; + bdev->holder_dir_ref = 0; device_del(pdev); out_put: put_device(pdev);