linux-block.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v2] drbd: Fix five use after free bugs in get_initial_state
@ 2021-05-24 14:58 Lv Yunlong
  2021-05-24 17:14 ` kernel test robot
  2021-05-24 20:45 ` kernel test robot
  0 siblings, 2 replies; 3+ messages in thread
From: Lv Yunlong @ 2021-05-24 14:58 UTC (permalink / raw)
  To: philipp.reisner, lars.ellenberg, axboe
  Cc: drbd-dev, linux-block, linux-kernel, Lv Yunlong

In get_initial_state, it calls notify_initial_state_done(skb,..) if
cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(),
the skb will be freed by nlmsg_free(skb).
Then get_initial_state will goto out and the freed skb will be used by
return value skb->len, which is a uaf bug.

What's worse, the same problem goes even further: skb can also be
freed in the notify_*_state_change -> notify_*_state calls below.
Thus 4 additional uaf bugs happened.

My patch lets the problem callee functions: notify_initial_state_done
and notify_*_state_change return an error code if errors happen.
So that the error codes could be propagated and the uaf bugs can be avoid.

v1 contains a compilation error. This v2 fixed this error and built
successfully in my local environment.

Fixes: a29728463b254 ("drbd: Backport the "events2" command")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
---
 drivers/block/drbd/drbd_int.h          |  8 ++---
 drivers/block/drbd/drbd_nl.c           | 41 ++++++++++++++++----------
 drivers/block/drbd/drbd_state.c        | 16 +++++-----
 drivers/block/drbd/drbd_state_change.h |  8 ++---
 4 files changed, 41 insertions(+), 32 deletions(-)

diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h
index 5d9181382ce1..0a5766a2f161 100644
--- a/drivers/block/drbd/drbd_int.h
+++ b/drivers/block/drbd/drbd_int.h
@@ -1642,22 +1642,22 @@ struct sib_info {
 };
 void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib);
 
-extern void notify_resource_state(struct sk_buff *,
+extern int notify_resource_state(struct sk_buff *,
 				  unsigned int,
 				  struct drbd_resource *,
 				  struct resource_info *,
 				  enum drbd_notification_type);
-extern void notify_device_state(struct sk_buff *,
+extern int notify_device_state(struct sk_buff *,
 				unsigned int,
 				struct drbd_device *,
 				struct device_info *,
 				enum drbd_notification_type);
-extern void notify_connection_state(struct sk_buff *,
+extern int notify_connection_state(struct sk_buff *,
 				    unsigned int,
 				    struct drbd_connection *,
 				    struct connection_info *,
 				    enum drbd_notification_type);
-extern void notify_peer_device_state(struct sk_buff *,
+extern int notify_peer_device_state(struct sk_buff *,
 				     unsigned int,
 				     struct drbd_peer_device *,
 				     struct peer_device_info *,
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index e7d0e637e632..18c4fea028e1 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -4617,7 +4617,7 @@ static int nla_put_notification_header(struct sk_buff *msg,
 	return drbd_notification_header_to_skb(msg, &nh, true);
 }
 
-void notify_resource_state(struct sk_buff *skb,
+int notify_resource_state(struct sk_buff *skb,
 			   unsigned int seq,
 			   struct drbd_resource *resource,
 			   struct resource_info *resource_info,
@@ -4659,16 +4659,17 @@ void notify_resource_state(struct sk_buff *skb,
 		if (err && err != -ESRCH)
 			goto failed;
 	}
-	return;
+	return 0;
 
 nla_put_failure:
 	nlmsg_free(skb);
 failed:
 	drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n",
 			err, seq);
+	return err;
 }
 
-void notify_device_state(struct sk_buff *skb,
+int notify_device_state(struct sk_buff *skb,
 			 unsigned int seq,
 			 struct drbd_device *device,
 			 struct device_info *device_info,
@@ -4708,16 +4709,17 @@ void notify_device_state(struct sk_buff *skb,
 		if (err && err != -ESRCH)
 			goto failed;
 	}
-	return;
+	return 0;
 
 nla_put_failure:
 	nlmsg_free(skb);
 failed:
 	drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n",
 		 err, seq);
+	return err;
 }
 
-void notify_connection_state(struct sk_buff *skb,
+int notify_connection_state(struct sk_buff *skb,
 			     unsigned int seq,
 			     struct drbd_connection *connection,
 			     struct connection_info *connection_info,
@@ -4757,16 +4759,17 @@ void notify_connection_state(struct sk_buff *skb,
 		if (err && err != -ESRCH)
 			goto failed;
 	}
-	return;
+	return 0;
 
 nla_put_failure:
 	nlmsg_free(skb);
 failed:
 	drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n",
 		 err, seq);
+	return err;
 }
 
-void notify_peer_device_state(struct sk_buff *skb,
+int notify_peer_device_state(struct sk_buff *skb,
 			      unsigned int seq,
 			      struct drbd_peer_device *peer_device,
 			      struct peer_device_info *peer_device_info,
@@ -4807,13 +4810,14 @@ void notify_peer_device_state(struct sk_buff *skb,
 		if (err && err != -ESRCH)
 			goto failed;
 	}
-	return;
+	return 0;
 
 nla_put_failure:
 	nlmsg_free(skb);
 failed:
 	drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n",
 		 err, seq);
+	return err;
 }
 
 void notify_helper(enum drbd_notification_type type,
@@ -4864,7 +4868,7 @@ void notify_helper(enum drbd_notification_type type,
 		 err, seq);
 }
 
-static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq)
+static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq)
 {
 	struct drbd_genlmsghdr *dh;
 	int err;
@@ -4878,11 +4882,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq)
 	if (nla_put_notification_header(skb, NOTIFY_EXISTS))
 		goto nla_put_failure;
 	genlmsg_end(skb, dh);
-	return;
+	return 0;
 
 nla_put_failure:
 	nlmsg_free(skb);
 	pr_err("Error %d sending event. Event seq:%u\n", err, seq);
+	return err;
 }
 
 static void free_state_changes(struct list_head *list)
@@ -4909,6 +4914,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb)
 	unsigned int seq = cb->args[2];
 	unsigned int n;
 	enum drbd_notification_type flags = 0;
+	int err = 0;
 
 	/* There is no need for taking notification_mutex here: it doesn't
 	   matter if the initial state events mix with later state chage
@@ -4917,32 +4923,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb)
 
 	cb->args[5]--;
 	if (cb->args[5] == 1) {
-		notify_initial_state_done(skb, seq);
+		err = notify_initial_state_done(skb, seq);
 		goto out;
 	}
 	n = cb->args[4]++;
 	if (cb->args[4] < cb->args[3])
 		flags |= NOTIFY_CONTINUES;
 	if (n < 1) {
-		notify_resource_state_change(skb, seq, state_change->resource,
+		err = notify_resource_state_change(skb, seq, state_change->resource,
 					     NOTIFY_EXISTS | flags);
 		goto next;
 	}
 	n--;
 	if (n < state_change->n_connections) {
-		notify_connection_state_change(skb, seq, &state_change->connections[n],
+		err = notify_connection_state_change(skb, seq, &state_change->connections[n],
 					       NOTIFY_EXISTS | flags);
 		goto next;
 	}
 	n -= state_change->n_connections;
 	if (n < state_change->n_devices) {
-		notify_device_state_change(skb, seq, &state_change->devices[n],
+		err = notify_device_state_change(skb, seq, &state_change->devices[n],
 					   NOTIFY_EXISTS | flags);
 		goto next;
 	}
 	n -= state_change->n_devices;
 	if (n < state_change->n_devices * state_change->n_connections) {
-		notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n],
+		err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n],
 						NOTIFY_EXISTS | flags);
 		goto next;
 	}
@@ -4957,7 +4963,10 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb)
 		cb->args[4] = 0;
 	}
 out:
-	return skb->len;
+	if (err)
+		return err;
+	else
+		return skb->len;
 }
 
 int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb)
diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c
index b8a27818ab3f..a650f91f2246 100644
--- a/drivers/block/drbd/drbd_state.c
+++ b/drivers/block/drbd/drbd_state.c
@@ -1537,7 +1537,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device,
 	return rv;
 }
 
-void notify_resource_state_change(struct sk_buff *skb,
+int notify_resource_state_change(struct sk_buff *skb,
 				  unsigned int seq,
 				  struct drbd_resource_state_change *resource_state_change,
 				  enum drbd_notification_type type)
@@ -1550,10 +1550,10 @@ void notify_resource_state_change(struct sk_buff *skb,
 		.res_susp_fen = resource_state_change->susp_fen[NEW],
 	};
 
-	notify_resource_state(skb, seq, resource, &resource_info, type);
+	return notify_resource_state(skb, seq, resource, &resource_info, type);
 }
 
-void notify_connection_state_change(struct sk_buff *skb,
+int notify_connection_state_change(struct sk_buff *skb,
 				    unsigned int seq,
 				    struct drbd_connection_state_change *connection_state_change,
 				    enum drbd_notification_type type)
@@ -1564,10 +1564,10 @@ void notify_connection_state_change(struct sk_buff *skb,
 		.conn_role = connection_state_change->peer_role[NEW],
 	};
 
-	notify_connection_state(skb, seq, connection, &connection_info, type);
+	return notify_connection_state(skb, seq, connection, &connection_info, type);
 }
 
-void notify_device_state_change(struct sk_buff *skb,
+int notify_device_state_change(struct sk_buff *skb,
 				unsigned int seq,
 				struct drbd_device_state_change *device_state_change,
 				enum drbd_notification_type type)
@@ -1577,10 +1577,10 @@ void notify_device_state_change(struct sk_buff *skb,
 		.dev_disk_state = device_state_change->disk_state[NEW],
 	};
 
-	notify_device_state(skb, seq, device, &device_info, type);
+	return notify_device_state(skb, seq, device, &device_info, type);
 }
 
-void notify_peer_device_state_change(struct sk_buff *skb,
+int notify_peer_device_state_change(struct sk_buff *skb,
 				     unsigned int seq,
 				     struct drbd_peer_device_state_change *p,
 				     enum drbd_notification_type type)
@@ -1594,7 +1594,7 @@ void notify_peer_device_state_change(struct sk_buff *skb,
 		.peer_resync_susp_dependency = p->resync_susp_dependency[NEW],
 	};
 
-	notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type);
+	return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type);
 }
 
 static void broadcast_state_change(struct drbd_state_change *state_change)
diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h
index ba80f612d6ab..d5b0479bc9a6 100644
--- a/drivers/block/drbd/drbd_state_change.h
+++ b/drivers/block/drbd/drbd_state_change.h
@@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_
 extern void copy_old_to_new_state_change(struct drbd_state_change *);
 extern void forget_state_change(struct drbd_state_change *);
 
-extern void notify_resource_state_change(struct sk_buff *,
+extern int notify_resource_state_change(struct sk_buff *,
 					 unsigned int,
 					 struct drbd_resource_state_change *,
 					 enum drbd_notification_type type);
-extern void notify_connection_state_change(struct sk_buff *,
+extern int notify_connection_state_change(struct sk_buff *,
 					   unsigned int,
 					   struct drbd_connection_state_change *,
 					   enum drbd_notification_type type);
-extern void notify_device_state_change(struct sk_buff *,
+extern int notify_device_state_change(struct sk_buff *,
 				       unsigned int,
 				       struct drbd_device_state_change *,
 				       enum drbd_notification_type type);
-extern void notify_peer_device_state_change(struct sk_buff *,
+extern int notify_peer_device_state_change(struct sk_buff *,
 					    unsigned int,
 					    struct drbd_peer_device_state_change *,
 					    enum drbd_notification_type type);
-- 
2.25.1



^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH v2] drbd: Fix five use after free bugs in get_initial_state
  2021-05-24 14:58 [PATCH v2] drbd: Fix five use after free bugs in get_initial_state Lv Yunlong
@ 2021-05-24 17:14 ` kernel test robot
  2021-05-24 20:45 ` kernel test robot
  1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2021-05-24 17:14 UTC (permalink / raw)
  To: Lv Yunlong, philipp.reisner, lars.ellenberg, axboe
  Cc: kbuild-all, drbd-dev, linux-block, linux-kernel, Lv Yunlong

[-- Attachment #1: Type: text/plain, Size: 10043 bytes --]

Hi Lv,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on block/for-next]
[also build test WARNING on linux/master linus/master v5.13-rc3 next-20210524]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Lv-Yunlong/drbd-Fix-five-use-after-free-bugs-in-get_initial_state/20210524-233429
base:   https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-next
config: um-allmodconfig (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce (this is a W=1 build):
        # https://github.com/0day-ci/linux/commit/869bb8c1a492179ef95ae5785302d1df14bd24d3
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Lv-Yunlong/drbd-Fix-five-use-after-free-bugs-in-get_initial_state/20210524-233429
        git checkout 869bb8c1a492179ef95ae5785302d1df14bd24d3
        # save the attached .config to linux build tree
        make W=1 ARCH=um 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All warnings (new ones prefixed by >>):

   drivers/block/drbd/drbd_state.c: In function 'broadcast_state_change':
   drivers/block/drbd/drbd_state.c:1616:17: warning: cast between incompatible function types from 'int (*)(struct sk_buff *, unsigned int,  struct drbd_resource_state_change *, enum drbd_notification_type)' to 'void (*)(struct sk_buff *, unsigned int,  void *, enum drbd_notification_type)' [-Wcast-function-type]
    1616 |     last_func = (typeof(last_func))func; \
         |                 ^
   drivers/block/drbd/drbd_state.c:1629:3: note: in expansion of macro 'REMEMBER_STATE_CHANGE'
    1629 |   REMEMBER_STATE_CHANGE(notify_resource_state_change,
         |   ^~~~~~~~~~~~~~~~~~~~~
   drivers/block/drbd/drbd_state.c:1616:17: warning: cast between incompatible function types from 'int (*)(struct sk_buff *, unsigned int,  struct drbd_connection_state_change *, enum drbd_notification_type)' to 'void (*)(struct sk_buff *, unsigned int,  void *, enum drbd_notification_type)' [-Wcast-function-type]
    1616 |     last_func = (typeof(last_func))func; \
         |                 ^
   drivers/block/drbd/drbd_state.c:1638:4: note: in expansion of macro 'REMEMBER_STATE_CHANGE'
    1638 |    REMEMBER_STATE_CHANGE(notify_connection_state_change,
         |    ^~~~~~~~~~~~~~~~~~~~~
>> drivers/block/drbd/drbd_state.c:1616:17: warning: cast between incompatible function types from 'int (*)(struct sk_buff *, unsigned int,  struct drbd_device_state_change *, enum drbd_notification_type)' to 'void (*)(struct sk_buff *, unsigned int,  void *, enum drbd_notification_type)' [-Wcast-function-type]
    1616 |     last_func = (typeof(last_func))func; \
         |                 ^
   drivers/block/drbd/drbd_state.c:1647:4: note: in expansion of macro 'REMEMBER_STATE_CHANGE'
    1647 |    REMEMBER_STATE_CHANGE(notify_device_state_change,
         |    ^~~~~~~~~~~~~~~~~~~~~
   drivers/block/drbd/drbd_state.c:1616:17: warning: cast between incompatible function types from 'int (*)(struct sk_buff *, unsigned int,  struct drbd_peer_device_state_change *, enum drbd_notification_type)' to 'void (*)(struct sk_buff *, unsigned int,  void *, enum drbd_notification_type)' [-Wcast-function-type]
    1616 |     last_func = (typeof(last_func))func; \
         |                 ^
   drivers/block/drbd/drbd_state.c:1661:4: note: in expansion of macro 'REMEMBER_STATE_CHANGE'
    1661 |    REMEMBER_STATE_CHANGE(notify_peer_device_state_change,
         |    ^~~~~~~~~~~~~~~~~~~~~


vim +1616 drivers/block/drbd/drbd_state.c

a29728463b254c Andreas Gruenbacher 2014-07-31  1599  
a29728463b254c Andreas Gruenbacher 2014-07-31  1600  static void broadcast_state_change(struct drbd_state_change *state_change)
a29728463b254c Andreas Gruenbacher 2014-07-31  1601  {
a29728463b254c Andreas Gruenbacher 2014-07-31  1602  	struct drbd_resource_state_change *resource_state_change = &state_change->resource[0];
a29728463b254c Andreas Gruenbacher 2014-07-31  1603  	bool resource_state_has_changed;
a29728463b254c Andreas Gruenbacher 2014-07-31  1604  	unsigned int n_device, n_connection, n_peer_device, n_peer_devices;
a29728463b254c Andreas Gruenbacher 2014-07-31  1605  	void (*last_func)(struct sk_buff *, unsigned int, void *,
a29728463b254c Andreas Gruenbacher 2014-07-31  1606  			  enum drbd_notification_type) = NULL;
805cdb8bc6da87 Kees Cook           2020-06-03  1607  	void *last_arg = NULL;
a29728463b254c Andreas Gruenbacher 2014-07-31  1608  
a29728463b254c Andreas Gruenbacher 2014-07-31  1609  #define HAS_CHANGED(state) ((state)[OLD] != (state)[NEW])
a29728463b254c Andreas Gruenbacher 2014-07-31  1610  #define FINAL_STATE_CHANGE(type) \
a29728463b254c Andreas Gruenbacher 2014-07-31  1611  	({ if (last_func) \
a29728463b254c Andreas Gruenbacher 2014-07-31  1612  		last_func(NULL, 0, last_arg, type); \
a29728463b254c Andreas Gruenbacher 2014-07-31  1613  	})
a29728463b254c Andreas Gruenbacher 2014-07-31  1614  #define REMEMBER_STATE_CHANGE(func, arg, type) \
a29728463b254c Andreas Gruenbacher 2014-07-31  1615  	({ FINAL_STATE_CHANGE(type | NOTIFY_CONTINUES); \
a29728463b254c Andreas Gruenbacher 2014-07-31 @1616  	   last_func = (typeof(last_func))func; \
a29728463b254c Andreas Gruenbacher 2014-07-31  1617  	   last_arg = arg; \
a29728463b254c Andreas Gruenbacher 2014-07-31  1618  	 })
a29728463b254c Andreas Gruenbacher 2014-07-31  1619  
a29728463b254c Andreas Gruenbacher 2014-07-31  1620  	mutex_lock(&notification_mutex);
a29728463b254c Andreas Gruenbacher 2014-07-31  1621  
a29728463b254c Andreas Gruenbacher 2014-07-31  1622  	resource_state_has_changed =
a29728463b254c Andreas Gruenbacher 2014-07-31  1623  	    HAS_CHANGED(resource_state_change->role) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1624  	    HAS_CHANGED(resource_state_change->susp) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1625  	    HAS_CHANGED(resource_state_change->susp_nod) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1626  	    HAS_CHANGED(resource_state_change->susp_fen);
a29728463b254c Andreas Gruenbacher 2014-07-31  1627  
a29728463b254c Andreas Gruenbacher 2014-07-31  1628  	if (resource_state_has_changed)
a29728463b254c Andreas Gruenbacher 2014-07-31  1629  		REMEMBER_STATE_CHANGE(notify_resource_state_change,
a29728463b254c Andreas Gruenbacher 2014-07-31  1630  				      resource_state_change, NOTIFY_CHANGE);
a29728463b254c Andreas Gruenbacher 2014-07-31  1631  
a29728463b254c Andreas Gruenbacher 2014-07-31  1632  	for (n_connection = 0; n_connection < state_change->n_connections; n_connection++) {
a29728463b254c Andreas Gruenbacher 2014-07-31  1633  		struct drbd_connection_state_change *connection_state_change =
a29728463b254c Andreas Gruenbacher 2014-07-31  1634  				&state_change->connections[n_connection];
a29728463b254c Andreas Gruenbacher 2014-07-31  1635  
a29728463b254c Andreas Gruenbacher 2014-07-31  1636  		if (HAS_CHANGED(connection_state_change->peer_role) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1637  		    HAS_CHANGED(connection_state_change->cstate))
a29728463b254c Andreas Gruenbacher 2014-07-31  1638  			REMEMBER_STATE_CHANGE(notify_connection_state_change,
a29728463b254c Andreas Gruenbacher 2014-07-31  1639  					      connection_state_change, NOTIFY_CHANGE);
a29728463b254c Andreas Gruenbacher 2014-07-31  1640  	}
a29728463b254c Andreas Gruenbacher 2014-07-31  1641  
a29728463b254c Andreas Gruenbacher 2014-07-31  1642  	for (n_device = 0; n_device < state_change->n_devices; n_device++) {
a29728463b254c Andreas Gruenbacher 2014-07-31  1643  		struct drbd_device_state_change *device_state_change =
a29728463b254c Andreas Gruenbacher 2014-07-31  1644  			&state_change->devices[n_device];
a29728463b254c Andreas Gruenbacher 2014-07-31  1645  
a29728463b254c Andreas Gruenbacher 2014-07-31  1646  		if (HAS_CHANGED(device_state_change->disk_state))
a29728463b254c Andreas Gruenbacher 2014-07-31  1647  			REMEMBER_STATE_CHANGE(notify_device_state_change,
a29728463b254c Andreas Gruenbacher 2014-07-31  1648  					      device_state_change, NOTIFY_CHANGE);
a29728463b254c Andreas Gruenbacher 2014-07-31  1649  	}
a29728463b254c Andreas Gruenbacher 2014-07-31  1650  
a29728463b254c Andreas Gruenbacher 2014-07-31  1651  	n_peer_devices = state_change->n_devices * state_change->n_connections;
a29728463b254c Andreas Gruenbacher 2014-07-31  1652  	for (n_peer_device = 0; n_peer_device < n_peer_devices; n_peer_device++) {
a29728463b254c Andreas Gruenbacher 2014-07-31  1653  		struct drbd_peer_device_state_change *p =
a29728463b254c Andreas Gruenbacher 2014-07-31  1654  			&state_change->peer_devices[n_peer_device];
a29728463b254c Andreas Gruenbacher 2014-07-31  1655  
a29728463b254c Andreas Gruenbacher 2014-07-31  1656  		if (HAS_CHANGED(p->disk_state) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1657  		    HAS_CHANGED(p->repl_state) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1658  		    HAS_CHANGED(p->resync_susp_user) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1659  		    HAS_CHANGED(p->resync_susp_peer) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1660  		    HAS_CHANGED(p->resync_susp_dependency))
a29728463b254c Andreas Gruenbacher 2014-07-31  1661  			REMEMBER_STATE_CHANGE(notify_peer_device_state_change,
a29728463b254c Andreas Gruenbacher 2014-07-31  1662  					      p, NOTIFY_CHANGE);
a29728463b254c Andreas Gruenbacher 2014-07-31  1663  	}
a29728463b254c Andreas Gruenbacher 2014-07-31  1664  
a29728463b254c Andreas Gruenbacher 2014-07-31  1665  	FINAL_STATE_CHANGE(NOTIFY_CHANGE);
a29728463b254c Andreas Gruenbacher 2014-07-31  1666  	mutex_unlock(&notification_mutex);
a29728463b254c Andreas Gruenbacher 2014-07-31  1667  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 24519 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH v2] drbd: Fix five use after free bugs in get_initial_state
  2021-05-24 14:58 [PATCH v2] drbd: Fix five use after free bugs in get_initial_state Lv Yunlong
  2021-05-24 17:14 ` kernel test robot
@ 2021-05-24 20:45 ` kernel test robot
  1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2021-05-24 20:45 UTC (permalink / raw)
  To: Lv Yunlong, philipp.reisner, lars.ellenberg, axboe
  Cc: kbuild-all, drbd-dev, linux-block, linux-kernel, Lv Yunlong

[-- Attachment #1: Type: text/plain, Size: 10245 bytes --]

Hi Lv,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on block/for-next]
[also build test WARNING on linux/master linus/master v5.13-rc3 next-20210524]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Lv-Yunlong/drbd-Fix-five-use-after-free-bugs-in-get_initial_state/20210524-233429
base:   https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-next
config: arc-randconfig-r025-20210524 (attached as .config)
compiler: arc-elf-gcc (GCC) 9.3.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/869bb8c1a492179ef95ae5785302d1df14bd24d3
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Lv-Yunlong/drbd-Fix-five-use-after-free-bugs-in-get_initial_state/20210524-233429
        git checkout 869bb8c1a492179ef95ae5785302d1df14bd24d3
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross ARCH=arc 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All warnings (new ones prefixed by >>):

   drivers/block/drbd/drbd_state.c: In function 'broadcast_state_change':
>> drivers/block/drbd/drbd_state.c:1616:17: warning: cast between incompatible function types from 'int (*)(struct sk_buff *, unsigned int,  struct drbd_resource_state_change *, enum drbd_notification_type)' to 'void (*)(struct sk_buff *, unsigned int,  void *, enum drbd_notification_type)' [-Wcast-function-type]
    1616 |     last_func = (typeof(last_func))func; \
         |                 ^
   drivers/block/drbd/drbd_state.c:1629:3: note: in expansion of macro 'REMEMBER_STATE_CHANGE'
    1629 |   REMEMBER_STATE_CHANGE(notify_resource_state_change,
         |   ^~~~~~~~~~~~~~~~~~~~~
>> drivers/block/drbd/drbd_state.c:1616:17: warning: cast between incompatible function types from 'int (*)(struct sk_buff *, unsigned int,  struct drbd_connection_state_change *, enum drbd_notification_type)' to 'void (*)(struct sk_buff *, unsigned int,  void *, enum drbd_notification_type)' [-Wcast-function-type]
    1616 |     last_func = (typeof(last_func))func; \
         |                 ^
   drivers/block/drbd/drbd_state.c:1638:4: note: in expansion of macro 'REMEMBER_STATE_CHANGE'
    1638 |    REMEMBER_STATE_CHANGE(notify_connection_state_change,
         |    ^~~~~~~~~~~~~~~~~~~~~
>> drivers/block/drbd/drbd_state.c:1616:17: warning: cast between incompatible function types from 'int (*)(struct sk_buff *, unsigned int,  struct drbd_device_state_change *, enum drbd_notification_type)' to 'void (*)(struct sk_buff *, unsigned int,  void *, enum drbd_notification_type)' [-Wcast-function-type]
    1616 |     last_func = (typeof(last_func))func; \
         |                 ^
   drivers/block/drbd/drbd_state.c:1647:4: note: in expansion of macro 'REMEMBER_STATE_CHANGE'
    1647 |    REMEMBER_STATE_CHANGE(notify_device_state_change,
         |    ^~~~~~~~~~~~~~~~~~~~~
>> drivers/block/drbd/drbd_state.c:1616:17: warning: cast between incompatible function types from 'int (*)(struct sk_buff *, unsigned int,  struct drbd_peer_device_state_change *, enum drbd_notification_type)' to 'void (*)(struct sk_buff *, unsigned int,  void *, enum drbd_notification_type)' [-Wcast-function-type]
    1616 |     last_func = (typeof(last_func))func; \
         |                 ^
   drivers/block/drbd/drbd_state.c:1661:4: note: in expansion of macro 'REMEMBER_STATE_CHANGE'
    1661 |    REMEMBER_STATE_CHANGE(notify_peer_device_state_change,
         |    ^~~~~~~~~~~~~~~~~~~~~


vim +1616 drivers/block/drbd/drbd_state.c

a29728463b254c Andreas Gruenbacher 2014-07-31  1599  
a29728463b254c Andreas Gruenbacher 2014-07-31  1600  static void broadcast_state_change(struct drbd_state_change *state_change)
a29728463b254c Andreas Gruenbacher 2014-07-31  1601  {
a29728463b254c Andreas Gruenbacher 2014-07-31  1602  	struct drbd_resource_state_change *resource_state_change = &state_change->resource[0];
a29728463b254c Andreas Gruenbacher 2014-07-31  1603  	bool resource_state_has_changed;
a29728463b254c Andreas Gruenbacher 2014-07-31  1604  	unsigned int n_device, n_connection, n_peer_device, n_peer_devices;
a29728463b254c Andreas Gruenbacher 2014-07-31  1605  	void (*last_func)(struct sk_buff *, unsigned int, void *,
a29728463b254c Andreas Gruenbacher 2014-07-31  1606  			  enum drbd_notification_type) = NULL;
805cdb8bc6da87 Kees Cook           2020-06-03  1607  	void *last_arg = NULL;
a29728463b254c Andreas Gruenbacher 2014-07-31  1608  
a29728463b254c Andreas Gruenbacher 2014-07-31  1609  #define HAS_CHANGED(state) ((state)[OLD] != (state)[NEW])
a29728463b254c Andreas Gruenbacher 2014-07-31  1610  #define FINAL_STATE_CHANGE(type) \
a29728463b254c Andreas Gruenbacher 2014-07-31  1611  	({ if (last_func) \
a29728463b254c Andreas Gruenbacher 2014-07-31  1612  		last_func(NULL, 0, last_arg, type); \
a29728463b254c Andreas Gruenbacher 2014-07-31  1613  	})
a29728463b254c Andreas Gruenbacher 2014-07-31  1614  #define REMEMBER_STATE_CHANGE(func, arg, type) \
a29728463b254c Andreas Gruenbacher 2014-07-31  1615  	({ FINAL_STATE_CHANGE(type | NOTIFY_CONTINUES); \
a29728463b254c Andreas Gruenbacher 2014-07-31 @1616  	   last_func = (typeof(last_func))func; \
a29728463b254c Andreas Gruenbacher 2014-07-31  1617  	   last_arg = arg; \
a29728463b254c Andreas Gruenbacher 2014-07-31  1618  	 })
a29728463b254c Andreas Gruenbacher 2014-07-31  1619  
a29728463b254c Andreas Gruenbacher 2014-07-31  1620  	mutex_lock(&notification_mutex);
a29728463b254c Andreas Gruenbacher 2014-07-31  1621  
a29728463b254c Andreas Gruenbacher 2014-07-31  1622  	resource_state_has_changed =
a29728463b254c Andreas Gruenbacher 2014-07-31  1623  	    HAS_CHANGED(resource_state_change->role) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1624  	    HAS_CHANGED(resource_state_change->susp) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1625  	    HAS_CHANGED(resource_state_change->susp_nod) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1626  	    HAS_CHANGED(resource_state_change->susp_fen);
a29728463b254c Andreas Gruenbacher 2014-07-31  1627  
a29728463b254c Andreas Gruenbacher 2014-07-31  1628  	if (resource_state_has_changed)
a29728463b254c Andreas Gruenbacher 2014-07-31  1629  		REMEMBER_STATE_CHANGE(notify_resource_state_change,
a29728463b254c Andreas Gruenbacher 2014-07-31  1630  				      resource_state_change, NOTIFY_CHANGE);
a29728463b254c Andreas Gruenbacher 2014-07-31  1631  
a29728463b254c Andreas Gruenbacher 2014-07-31  1632  	for (n_connection = 0; n_connection < state_change->n_connections; n_connection++) {
a29728463b254c Andreas Gruenbacher 2014-07-31  1633  		struct drbd_connection_state_change *connection_state_change =
a29728463b254c Andreas Gruenbacher 2014-07-31  1634  				&state_change->connections[n_connection];
a29728463b254c Andreas Gruenbacher 2014-07-31  1635  
a29728463b254c Andreas Gruenbacher 2014-07-31  1636  		if (HAS_CHANGED(connection_state_change->peer_role) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1637  		    HAS_CHANGED(connection_state_change->cstate))
a29728463b254c Andreas Gruenbacher 2014-07-31  1638  			REMEMBER_STATE_CHANGE(notify_connection_state_change,
a29728463b254c Andreas Gruenbacher 2014-07-31  1639  					      connection_state_change, NOTIFY_CHANGE);
a29728463b254c Andreas Gruenbacher 2014-07-31  1640  	}
a29728463b254c Andreas Gruenbacher 2014-07-31  1641  
a29728463b254c Andreas Gruenbacher 2014-07-31  1642  	for (n_device = 0; n_device < state_change->n_devices; n_device++) {
a29728463b254c Andreas Gruenbacher 2014-07-31  1643  		struct drbd_device_state_change *device_state_change =
a29728463b254c Andreas Gruenbacher 2014-07-31  1644  			&state_change->devices[n_device];
a29728463b254c Andreas Gruenbacher 2014-07-31  1645  
a29728463b254c Andreas Gruenbacher 2014-07-31  1646  		if (HAS_CHANGED(device_state_change->disk_state))
a29728463b254c Andreas Gruenbacher 2014-07-31  1647  			REMEMBER_STATE_CHANGE(notify_device_state_change,
a29728463b254c Andreas Gruenbacher 2014-07-31  1648  					      device_state_change, NOTIFY_CHANGE);
a29728463b254c Andreas Gruenbacher 2014-07-31  1649  	}
a29728463b254c Andreas Gruenbacher 2014-07-31  1650  
a29728463b254c Andreas Gruenbacher 2014-07-31  1651  	n_peer_devices = state_change->n_devices * state_change->n_connections;
a29728463b254c Andreas Gruenbacher 2014-07-31  1652  	for (n_peer_device = 0; n_peer_device < n_peer_devices; n_peer_device++) {
a29728463b254c Andreas Gruenbacher 2014-07-31  1653  		struct drbd_peer_device_state_change *p =
a29728463b254c Andreas Gruenbacher 2014-07-31  1654  			&state_change->peer_devices[n_peer_device];
a29728463b254c Andreas Gruenbacher 2014-07-31  1655  
a29728463b254c Andreas Gruenbacher 2014-07-31  1656  		if (HAS_CHANGED(p->disk_state) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1657  		    HAS_CHANGED(p->repl_state) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1658  		    HAS_CHANGED(p->resync_susp_user) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1659  		    HAS_CHANGED(p->resync_susp_peer) ||
a29728463b254c Andreas Gruenbacher 2014-07-31  1660  		    HAS_CHANGED(p->resync_susp_dependency))
a29728463b254c Andreas Gruenbacher 2014-07-31  1661  			REMEMBER_STATE_CHANGE(notify_peer_device_state_change,
a29728463b254c Andreas Gruenbacher 2014-07-31  1662  					      p, NOTIFY_CHANGE);
a29728463b254c Andreas Gruenbacher 2014-07-31  1663  	}
a29728463b254c Andreas Gruenbacher 2014-07-31  1664  
a29728463b254c Andreas Gruenbacher 2014-07-31  1665  	FINAL_STATE_CHANGE(NOTIFY_CHANGE);
a29728463b254c Andreas Gruenbacher 2014-07-31  1666  	mutex_unlock(&notification_mutex);
a29728463b254c Andreas Gruenbacher 2014-07-31  1667  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 34214 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-05-24 20:45 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-24 14:58 [PATCH v2] drbd: Fix five use after free bugs in get_initial_state Lv Yunlong
2021-05-24 17:14 ` kernel test robot
2021-05-24 20:45 ` kernel test robot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).