* [PATCH] blktrace: fix dereference after null check
@ 2020-03-03 7:33 Cengiz Can
2020-03-03 13:29 ` Bob Liu
2020-03-03 14:14 ` Steven Rostedt
0 siblings, 2 replies; 6+ messages in thread
From: Cengiz Can @ 2020-03-03 7:33 UTC (permalink / raw)
To: Jens Axboe, Steven Rostedt, Ingo Molnar
Cc: linux-block, linux-kernel, Cengiz Can
There was a recent change in blktrace.c that added a RCU protection to
`q->blk_trace` in order to fix a use-after-free issue during access.
However the change missed an edge case that can lead to dereferencing of
`bt` pointer even when it's NULL:
```
bt->act_mask = value; // bt can still be NULL here
```
Added a reassignment into the NULL check block to fix the issue.
Fixes: c780e86dd48 ("blktrace: Protect q->blk_trace with RCU")
Signed-off-by: Cengiz Can <cengiz@kernel.wtf>
---
Huge thanks goes to Steven Rostedt for his assistance.
kernel/trace/blktrace.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 4560878f0bac..29ea88f10b87 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -1896,8 +1896,10 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
}
ret = 0;
- if (bt == NULL)
+ if (bt == NULL) {
ret = blk_trace_setup_queue(q, bdev);
+ bt = q->blk_trace;
+ }
if (ret == 0) {
if (attr == &dev_attr_act_mask)
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] blktrace: fix dereference after null check
2020-03-03 7:33 [PATCH] blktrace: fix dereference after null check Cengiz Can
@ 2020-03-03 13:29 ` Bob Liu
2020-03-03 13:35 ` Steven Rostedt
2020-03-03 14:14 ` Steven Rostedt
1 sibling, 1 reply; 6+ messages in thread
From: Bob Liu @ 2020-03-03 13:29 UTC (permalink / raw)
To: Cengiz Can, Jens Axboe, Steven Rostedt, Ingo Molnar
Cc: linux-block, linux-kernel
On 3/3/20 3:33 PM, Cengiz Can wrote:
> There was a recent change in blktrace.c that added a RCU protection to
> `q->blk_trace` in order to fix a use-after-free issue during access.
>
> However the change missed an edge case that can lead to dereferencing of
> `bt` pointer even when it's NULL:
>
> ```
> bt->act_mask = value; // bt can still be NULL here
> ```
>
> Added a reassignment into the NULL check block to fix the issue.
>
> Fixes: c780e86dd48 ("blktrace: Protect q->blk_trace with RCU")
>
> Signed-off-by: Cengiz Can <cengiz@kernel.wtf>
> ---
> Huge thanks goes to Steven Rostedt for his assistance.
>
> kernel/trace/blktrace.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
> index 4560878f0bac..29ea88f10b87 100644
> --- a/kernel/trace/blktrace.c
> +++ b/kernel/trace/blktrace.c
> @@ -1896,8 +1896,10 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
> }
>
> ret = 0;
> - if (bt == NULL)
> + if (bt == NULL) {
> ret = blk_trace_setup_queue(q, bdev);
> + bt = q->blk_trace;
The return value 'ret' should be judged, it's wrong to set 'bt' if blk_trace_setup_queue()
return failure.
> + }
>
> if (ret == 0) {
> if (attr == &dev_attr_act_mask)
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] blktrace: fix dereference after null check
2020-03-03 13:29 ` Bob Liu
@ 2020-03-03 13:35 ` Steven Rostedt
2020-03-03 13:44 ` Bob Liu
0 siblings, 1 reply; 6+ messages in thread
From: Steven Rostedt @ 2020-03-03 13:35 UTC (permalink / raw)
To: Bob Liu; +Cc: Cengiz Can, Jens Axboe, Ingo Molnar, linux-block, linux-kernel
On Tue, 3 Mar 2020 21:29:08 +0800
Bob Liu <bob.liu@oracle.com> wrote:
> On 3/3/20 3:33 PM, Cengiz Can wrote:
> > There was a recent change in blktrace.c that added a RCU protection to
> > `q->blk_trace` in order to fix a use-after-free issue during access.
> >
> > However the change missed an edge case that can lead to dereferencing of
> > `bt` pointer even when it's NULL:
> >
> > ```
> > bt->act_mask = value; // bt can still be NULL here
> > ```
> >
> > Added a reassignment into the NULL check block to fix the issue.
> >
> > Fixes: c780e86dd48 ("blktrace: Protect q->blk_trace with RCU")
> >
> > Signed-off-by: Cengiz Can <cengiz@kernel.wtf>
> > ---
> > Huge thanks goes to Steven Rostedt for his assistance.
> >
> > kernel/trace/blktrace.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
> > index 4560878f0bac..29ea88f10b87 100644
> > --- a/kernel/trace/blktrace.c
> > +++ b/kernel/trace/blktrace.c
> > @@ -1896,8 +1896,10 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
> > }
> >
> > ret = 0;
> > - if (bt == NULL)
> > + if (bt == NULL) {
> > ret = blk_trace_setup_queue(q, bdev);
> > + bt = q->blk_trace;
>
> The return value 'ret' should be judged, it's wrong to set 'bt' if blk_trace_setup_queue()
> return failure.
Why? If ret is an error, q is still valid, and bt would just be garbage. bt
is ignored below if ret is anything but zero. Why add an unnecessary if
condition here?
That said, the bt assignment still needs rcu annotation:
bt = rcu_dereference_protected(q->blk_trace,
lockdep_is_held(&q->blk_trace_mutex));
-- Steve
>
> > + }
> >
> > if (ret == 0) {
> > if (attr == &dev_attr_act_mask)
> > --
> > 2.25.1
> >
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] blktrace: fix dereference after null check
2020-03-03 13:35 ` Steven Rostedt
@ 2020-03-03 13:44 ` Bob Liu
0 siblings, 0 replies; 6+ messages in thread
From: Bob Liu @ 2020-03-03 13:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Cengiz Can, Jens Axboe, Ingo Molnar, linux-block, linux-kernel
On 3/3/20 9:35 PM, Steven Rostedt wrote:
> On Tue, 3 Mar 2020 21:29:08 +0800
> Bob Liu <bob.liu@oracle.com> wrote:
>
>> On 3/3/20 3:33 PM, Cengiz Can wrote:
>>> There was a recent change in blktrace.c that added a RCU protection to
>>> `q->blk_trace` in order to fix a use-after-free issue during access.
>>>
>>> However the change missed an edge case that can lead to dereferencing of
>>> `bt` pointer even when it's NULL:
>>>
>>> ```
>>> bt->act_mask = value; // bt can still be NULL here
>>> ```
>>>
>>> Added a reassignment into the NULL check block to fix the issue.
>>>
>>> Fixes: c780e86dd48 ("blktrace: Protect q->blk_trace with RCU")
>>>
>>> Signed-off-by: Cengiz Can <cengiz@kernel.wtf>
>>> ---
>>> Huge thanks goes to Steven Rostedt for his assistance.
>>>
>>> kernel/trace/blktrace.c | 4 +++-
>>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
>>> index 4560878f0bac..29ea88f10b87 100644
>>> --- a/kernel/trace/blktrace.c
>>> +++ b/kernel/trace/blktrace.c
>>> @@ -1896,8 +1896,10 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
>>> }
>>>
>>> ret = 0;
>>> - if (bt == NULL)
>>> + if (bt == NULL) {
>>> ret = blk_trace_setup_queue(q, bdev);
>>> + bt = q->blk_trace;
>>
>> The return value 'ret' should be judged, it's wrong to set 'bt' if blk_trace_setup_queue()
>> return failure.
>
> Why? If ret is an error, q is still valid, and bt would just be garbage. bt
> is ignored below if ret is anything but zero. Why add an unnecessary if
> condition here?
>
Oh..yes. You are right, sorry for missed the if (ret == 0) below.
Reviewed-by: Bob Liu <bob.liu@oracle.com>
> That said, the bt assignment still needs rcu annotation:
> > bt = rcu_dereference_protected(q->blk_trace,
> lockdep_is_held(&q->blk_trace_mutex));
>
> -- Steve
>
>
>>
>>> + }
>>>
>>> if (ret == 0) {
>>> if (attr == &dev_attr_act_mask)
>>> --
>>> 2.25.1
>>>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] blktrace: fix dereference after null check
2020-03-03 7:33 [PATCH] blktrace: fix dereference after null check Cengiz Can
2020-03-03 13:29 ` Bob Liu
@ 2020-03-03 14:14 ` Steven Rostedt
2020-03-04 11:07 ` Cengiz Can
1 sibling, 1 reply; 6+ messages in thread
From: Steven Rostedt @ 2020-03-03 14:14 UTC (permalink / raw)
To: Cengiz Can; +Cc: Jens Axboe, Ingo Molnar, linux-block, linux-kernel
On Tue, 3 Mar 2020 10:33:59 +0300
Cengiz Can <cengiz@kernel.wtf> wrote:
> There was a recent change in blktrace.c that added a RCU protection to
> `q->blk_trace` in order to fix a use-after-free issue during access.
>
> However the change missed an edge case that can lead to dereferencing of
> `bt` pointer even when it's NULL:
>
> ```
> bt->act_mask = value; // bt can still be NULL here
> ```
>
> Added a reassignment into the NULL check block to fix the issue.
Note, you should probably add a note in your change log that this issue was
found by Coverity. Sometimes static analyzers have a tag of some kind that
they would like patches that fix the issues they discover to be in the
change log. This way they can track the fixes that are found by the tool.
>
> Fixes: c780e86dd48 ("blktrace: Protect q->blk_trace with RCU")
>
> Signed-off-by: Cengiz Can <cengiz@kernel.wtf>
> ---
> Huge thanks goes to Steven Rostedt for his assistance.
>
> kernel/trace/blktrace.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
> index 4560878f0bac..29ea88f10b87 100644
> --- a/kernel/trace/blktrace.c
> +++ b/kernel/trace/blktrace.c
> @@ -1896,8 +1896,10 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
> }
>
> ret = 0;
> - if (bt == NULL)
> + if (bt == NULL) {
> ret = blk_trace_setup_queue(q, bdev);
> + bt = q->blk_trace;
As I said in the other email, the above assignment still needs RCU
annotation:
bt = rcu_dereference_protected(q->blk_trace,
lockdep_is_held(&q->blk_trace_mutex));
Otherwise, other static analyzers will flag this as a problem.
-- Steve
> + }
>
> if (ret == 0) {
> if (attr == &dev_attr_act_mask)
> --
> 2.25.1
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] blktrace: fix dereference after null check
2020-03-03 14:14 ` Steven Rostedt
@ 2020-03-04 11:07 ` Cengiz Can
0 siblings, 0 replies; 6+ messages in thread
From: Cengiz Can @ 2020-03-04 11:07 UTC (permalink / raw)
To: Steven Rostedt; +Cc: Jens Axboe, Ingo Molnar, linux-block, linux-kernel
On 2020-03-03 17:14, Steven Rostedt wrote:
>
> Note, you should probably add a note in your change log that this issue
> was
> found by Coverity. Sometimes static analyzers have a tag of some kind
> that
> they would like patches that fix the issues they discover to be in the
> change log. This way they can track the fixes that are found by the
> tool.
>
I have added the Coverity issue ID and relevant notes to mark it.
Thanks.
>
> As I said in the other email, the above assignment still needs RCU
> annotation:
>
> bt = rcu_dereference_protected(q->blk_trace,
> lockdep_is_held(&q->blk_trace_mutex));
I missed that. Thanks for reminding. TIL.
Please check PATCH-v2.
--
Cengiz Can
@cengiz_io
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-03-04 11:07 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-03 7:33 [PATCH] blktrace: fix dereference after null check Cengiz Can
2020-03-03 13:29 ` Bob Liu
2020-03-03 13:35 ` Steven Rostedt
2020-03-03 13:44 ` Bob Liu
2020-03-03 14:14 ` Steven Rostedt
2020-03-04 11:07 ` Cengiz Can
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.