* [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
@ 2018-10-15 13:25 Vasilis Liaskovitis
0 siblings, 0 replies; 10+ messages in thread
From: Vasilis Liaskovitis @ 2018-10-15 13:25 UTC (permalink / raw)
To: xen-devel, linux-kernel, linux-block
Cc: jgross, axboe, boris.ostrovsky, konrad.wilk, roger.pau
If a block device is hot-added when we are out of grants,
gnttab_grant_foreign_access fails with -ENOSPC (log message "28
granting access to ring page") in this code path:
talk_to_blkback ->
setup_blkring ->
xenbus_grant_ring ->
gnttab_grant_foreign_access
and the failing path in talk_to_blkback sets the driver_data to NULL:
destroy_blkring:
blkif_free(info, 0);
mutex_lock(&blkfront_mutex);
free_info(info);
mutex_unlock(&blkfront_mutex);
dev_set_drvdata(&dev->dev, NULL);
This results in a NULL pointer BUG when blkfront_remove and blkif_free
try to access the failing device's NULL struct blkfront_info.
Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com>
---
drivers/block/xen-blkfront.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 429d20131c7e..8871bf4c8a2e 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2493,6 +2493,9 @@ static int blkfront_remove(struct xenbus_device *xbdev)
dev_dbg(&xbdev->dev, "%s removed", xbdev->nodename);
+ if (!info)
+ return 0;
+
blkif_free(info, 0);
mutex_lock(&info->mutex);
--
2.19.0
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
2018-10-15 14:25 ` Vasilis Liaskovitis
@ 2018-10-18 23:54 ` Konrad Rzeszutek Wilk
2018-10-18 23:54 ` Konrad Rzeszutek Wilk
1 sibling, 0 replies; 10+ messages in thread
From: Konrad Rzeszutek Wilk @ 2018-10-18 23:54 UTC (permalink / raw)
To: Vasilis Liaskovitis
Cc: Roger Pau Monné,
xen-devel, linux-kernel, linux-block, jgross, boris.ostrovsky,
axboe
On Mon, Oct 15, 2018 at 04:25:56PM +0200, Vasilis Liaskovitis wrote:
> On Mon, 2018-10-15 at 16:02 +0200, Roger Pau Monn� wrote:
> >
> > > This results in a NULL pointer BUG when blkfront_remove and
> > > blkif_free
> > > try to access the failing device's NULL struct blkfront_info.
> > >
> > >
> > I guess this is a candidate for backporting?
> >
>
> yes, I think so. At least for kernels >=4.5, which could face this
> issue due to commit c31ecf6c12 (this frees the struct blkinfo in the
> failing path of talk_to_blkback).
OK, applied with Cc: stable@vger.kernel.org
>
> thanks,
>
> - Vasilis
>
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
@ 2018-10-18 23:54 ` Konrad Rzeszutek Wilk
0 siblings, 0 replies; 10+ messages in thread
From: Konrad Rzeszutek Wilk @ 2018-10-18 23:54 UTC (permalink / raw)
To: Vasilis Liaskovitis
Cc: Roger Pau Monné,
xen-devel, linux-kernel, linux-block, jgross, boris.ostrovsky,
axboe
On Mon, Oct 15, 2018 at 04:25:56PM +0200, Vasilis Liaskovitis wrote:
> On Mon, 2018-10-15 at 16:02 +0200, Roger Pau Monné wrote:
> >
> > > This results in a NULL pointer BUG when blkfront_remove and
> > > blkif_free
> > > try to access the failing device's NULL struct blkfront_info.
> > >
> > >
> > I guess this is a candidate for backporting?
> >
>
> yes, I think so. At least for kernels >=4.5, which could face this
> issue due to commit c31ecf6c12 (this frees the struct blkinfo in the
> failing path of talk_to_blkback).
OK, applied with Cc: stable@vger.kernel.org
>
> thanks,
>
> - Vasilis
>
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
2018-10-15 14:25 ` Vasilis Liaskovitis
2018-10-18 23:54 ` Konrad Rzeszutek Wilk
@ 2018-10-18 23:54 ` Konrad Rzeszutek Wilk
1 sibling, 0 replies; 10+ messages in thread
From: Konrad Rzeszutek Wilk @ 2018-10-18 23:54 UTC (permalink / raw)
To: Vasilis Liaskovitis
Cc: jgross, axboe, linux-kernel, linux-block, xen-devel,
boris.ostrovsky, Roger Pau Monné
On Mon, Oct 15, 2018 at 04:25:56PM +0200, Vasilis Liaskovitis wrote:
> On Mon, 2018-10-15 at 16:02 +0200, Roger Pau Monné wrote:
> >
> > > This results in a NULL pointer BUG when blkfront_remove and
> > > blkif_free
> > > try to access the failing device's NULL struct blkfront_info.
> > >
> > >
> > I guess this is a candidate for backporting?
> >
>
> yes, I think so. At least for kernels >=4.5, which could face this
> issue due to commit c31ecf6c12 (this frees the struct blkinfo in the
> failing path of talk_to_blkback).
OK, applied with Cc: stable@vger.kernel.org
>
> thanks,
>
> - Vasilis
>
>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
2018-10-15 14:02 ` Roger Pau Monné
(?)
@ 2018-10-15 14:25 ` Vasilis Liaskovitis
2018-10-18 23:54 ` Konrad Rzeszutek Wilk
2018-10-18 23:54 ` Konrad Rzeszutek Wilk
-1 siblings, 2 replies; 10+ messages in thread
From: Vasilis Liaskovitis @ 2018-10-15 14:25 UTC (permalink / raw)
To: Roger Pau Monné
Cc: xen-devel, linux-kernel, linux-block, jgross, boris.ostrovsky,
konrad.wilk, axboe
On Mon, 2018-10-15 at 16:02 +0200, Roger Pau Monné wrote:
>
> > This results in a NULL pointer BUG when blkfront_remove and
> > blkif_free
> > try to access the failing device's NULL struct blkfront_info.
> >
> >
> I guess this is a candidate for backporting?
>
yes, I think so. At least for kernels >=4.5, which could face this
issue due to commit c31ecf6c12 (this frees the struct blkinfo in the
failing path of talk_to_blkback).
thanks,
- Vasilis
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
2018-10-15 14:02 ` Roger Pau Monné
(?)
(?)
@ 2018-10-15 14:25 ` Vasilis Liaskovitis
-1 siblings, 0 replies; 10+ messages in thread
From: Vasilis Liaskovitis @ 2018-10-15 14:25 UTC (permalink / raw)
To: Roger Pau Monné
Cc: jgross, axboe, konrad.wilk, linux-kernel, linux-block, xen-devel,
boris.ostrovsky
On Mon, 2018-10-15 at 16:02 +0200, Roger Pau Monné wrote:
>
> > This results in a NULL pointer BUG when blkfront_remove and
> > blkif_free
> > try to access the failing device's NULL struct blkfront_info.
> >
> >
> I guess this is a candidate for backporting?
>
yes, I think so. At least for kernels >=4.5, which could face this
issue due to commit c31ecf6c12 (this frees the struct blkinfo in the
failing path of talk_to_blkback).
thanks,
- Vasilis
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
2018-10-15 13:25 Vasilis Liaskovitis
@ 2018-10-15 14:02 ` Roger Pau Monné
2018-10-15 14:02 ` Roger Pau Monné
1 sibling, 0 replies; 10+ messages in thread
From: Roger Pau Monné @ 2018-10-15 14:02 UTC (permalink / raw)
To: Vasilis Liaskovitis
Cc: xen-devel, linux-kernel, linux-block, jgross, boris.ostrovsky,
konrad.wilk, axboe
On Mon, Oct 15, 2018 at 03:25:08PM +0200, Vasilis Liaskovitis wrote:
> If a block device is hot-added when we are out of grants,
> gnttab_grant_foreign_access fails with -ENOSPC (log message "28
> granting access to ring page") in this code path:
>
> talk_to_blkback ->
> setup_blkring ->
> xenbus_grant_ring ->
> gnttab_grant_foreign_access
>
> and the failing path in talk_to_blkback sets the driver_data to NULL:
>
> destroy_blkring:
> blkif_free(info, 0);
>
> mutex_lock(&blkfront_mutex);
> free_info(info);
> mutex_unlock(&blkfront_mutex);
>
> dev_set_drvdata(&dev->dev, NULL);
>
> This results in a NULL pointer BUG when blkfront_remove and blkif_free
> try to access the failing device's NULL struct blkfront_info.
>
> Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com>
Reviewed-by: Roger Pau Monn� <roger.pau@citrix.com>
Thanks.
I guess this is a candidate for backporting?
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
@ 2018-10-15 14:02 ` Roger Pau Monné
0 siblings, 0 replies; 10+ messages in thread
From: Roger Pau Monné @ 2018-10-15 14:02 UTC (permalink / raw)
To: Vasilis Liaskovitis
Cc: xen-devel, linux-kernel, linux-block, jgross, boris.ostrovsky,
konrad.wilk, axboe
On Mon, Oct 15, 2018 at 03:25:08PM +0200, Vasilis Liaskovitis wrote:
> If a block device is hot-added when we are out of grants,
> gnttab_grant_foreign_access fails with -ENOSPC (log message "28
> granting access to ring page") in this code path:
>
> talk_to_blkback ->
> setup_blkring ->
> xenbus_grant_ring ->
> gnttab_grant_foreign_access
>
> and the failing path in talk_to_blkback sets the driver_data to NULL:
>
> destroy_blkring:
> blkif_free(info, 0);
>
> mutex_lock(&blkfront_mutex);
> free_info(info);
> mutex_unlock(&blkfront_mutex);
>
> dev_set_drvdata(&dev->dev, NULL);
>
> This results in a NULL pointer BUG when blkfront_remove and blkif_free
> try to access the failing device's NULL struct blkfront_info.
>
> Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Thanks.
I guess this is a candidate for backporting?
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
2018-10-15 13:25 Vasilis Liaskovitis
@ 2018-10-15 14:02 ` Roger Pau Monné
2018-10-15 14:02 ` Roger Pau Monné
1 sibling, 0 replies; 10+ messages in thread
From: Roger Pau Monné @ 2018-10-15 14:02 UTC (permalink / raw)
To: Vasilis Liaskovitis
Cc: jgross, axboe, konrad.wilk, linux-kernel, linux-block, xen-devel,
boris.ostrovsky
On Mon, Oct 15, 2018 at 03:25:08PM +0200, Vasilis Liaskovitis wrote:
> If a block device is hot-added when we are out of grants,
> gnttab_grant_foreign_access fails with -ENOSPC (log message "28
> granting access to ring page") in this code path:
>
> talk_to_blkback ->
> setup_blkring ->
> xenbus_grant_ring ->
> gnttab_grant_foreign_access
>
> and the failing path in talk_to_blkback sets the driver_data to NULL:
>
> destroy_blkring:
> blkif_free(info, 0);
>
> mutex_lock(&blkfront_mutex);
> free_info(info);
> mutex_unlock(&blkfront_mutex);
>
> dev_set_drvdata(&dev->dev, NULL);
>
> This results in a NULL pointer BUG when blkfront_remove and blkif_free
> try to access the failing device's NULL struct blkfront_info.
>
> Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Thanks.
I guess this is a candidate for backporting?
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
@ 2018-10-15 13:25 Vasilis Liaskovitis
2018-10-15 14:02 ` Roger Pau Monné
2018-10-15 14:02 ` Roger Pau Monné
0 siblings, 2 replies; 10+ messages in thread
From: Vasilis Liaskovitis @ 2018-10-15 13:25 UTC (permalink / raw)
To: xen-devel, linux-kernel, linux-block
Cc: jgross, boris.ostrovsky, roger.pau, konrad.wilk, axboe
If a block device is hot-added when we are out of grants,
gnttab_grant_foreign_access fails with -ENOSPC (log message "28
granting access to ring page") in this code path:
talk_to_blkback ->
setup_blkring ->
xenbus_grant_ring ->
gnttab_grant_foreign_access
and the failing path in talk_to_blkback sets the driver_data to NULL:
destroy_blkring:
blkif_free(info, 0);
mutex_lock(&blkfront_mutex);
free_info(info);
mutex_unlock(&blkfront_mutex);
dev_set_drvdata(&dev->dev, NULL);
This results in a NULL pointer BUG when blkfront_remove and blkif_free
try to access the failing device's NULL struct blkfront_info.
Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com>
---
drivers/block/xen-blkfront.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 429d20131c7e..8871bf4c8a2e 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2493,6 +2493,9 @@ static int blkfront_remove(struct xenbus_device *xbdev)
dev_dbg(&xbdev->dev, "%s removed", xbdev->nodename);
+ if (!info)
+ return 0;
+
blkif_free(info, 0);
mutex_lock(&info->mutex);
--
2.19.0
^ permalink raw reply related [flat|nested] 10+ messages in thread
end of thread, other threads:[~2018-10-18 23:54 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-10-15 13:25 [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal Vasilis Liaskovitis
-- strict thread matches above, loose matches on Subject: below --
2018-10-15 13:25 Vasilis Liaskovitis
2018-10-15 14:02 ` Roger Pau Monné
2018-10-15 14:02 ` Roger Pau Monné
2018-10-15 14:02 ` Roger Pau Monné
2018-10-15 14:25 ` Vasilis Liaskovitis
2018-10-18 23:54 ` Konrad Rzeszutek Wilk
2018-10-18 23:54 ` Konrad Rzeszutek Wilk
2018-10-18 23:54 ` Konrad Rzeszutek Wilk
2018-10-15 14:25 ` Vasilis Liaskovitis
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.