From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
To: syzbot <syzbot+8281086e8a6fbfbd952a@syzkaller.appspotmail.com>,
axboe@kernel.dk, linux-block@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] KASAN: use-after-free Read in bdev_free_inode
Date: Sun, 19 Sep 2021 22:37:34 +0900 [thread overview]
Message-ID: <41766564-08cb-e7f2-4cb2-9ad102f21324@I-love.SAKURA.ne.jp> (raw)
In-Reply-To: <0000000000004a5adf05cc593ca9@google.com>
This seems to be kfree() before RCU grace period.
struct block_device *bdev_alloc(struct gendisk *disk, u8 partno)
{
struct block_device *bdev;
struct inode *inode;
inode = new_inode(blockdev_superblock);
if (!inode)
return NULL;
inode->i_mode = S_IFBLK;
inode->i_rdev = 0;
inode->i_data.a_ops = &def_blk_aops;
mapping_set_gfp_mask(&inode->i_data, GFP_USER);
bdev = I_BDEV(inode);
mutex_init(&bdev->bd_fsfreeze_mutex);
spin_lock_init(&bdev->bd_size_lock);
bdev->bd_disk = disk; // <= Assigns pointer to "disk".
bdev->bd_partno = partno;
bdev->bd_inode = inode;
bdev->bd_stats = alloc_percpu(struct disk_stats);
if (!bdev->bd_stats) {
iput(inode); // <= Will call bdev_free_inode() via i_callback() after RCU from destroy_inode() from evict() from iput_final() from iput().
return NULL;
}
return bdev;
}
struct gendisk *__alloc_disk_node(struct request_queue *q, int node_id,
struct lock_class_key *lkclass)
{
struct gendisk *disk;
if (!blk_get_queue(q))
return NULL;
disk = kzalloc_node(sizeof(struct gendisk), GFP_KERNEL, node_id);
if (!disk)
goto out_put_queue;
disk->bdi = bdi_alloc(node_id);
if (!disk->bdi)
goto out_free_disk;
disk->part0 = bdev_alloc(disk, 0);
if (!disk->part0)
goto out_free_bdi;
disk->node_id = node_id;
mutex_init(&disk->open_mutex);
xa_init(&disk->part_tbl);
if (xa_insert(&disk->part_tbl, 0, disk->part0, GFP_KERNEL))
goto out_destroy_part_tbl;
rand_initialize_disk(disk);
disk_to_dev(disk)->class = &block_class;
disk_to_dev(disk)->type = &disk_type;
device_initialize(disk_to_dev(disk));
inc_diskseq(disk);
disk->queue = q;
q->disk = disk;
lockdep_init_map(&disk->lockdep_map, "(bio completion)", lkclass, 0);
#ifdef CONFIG_BLOCK_HOLDER_DEPRECATED
INIT_LIST_HEAD(&disk->slave_bdevs);
#endif
return disk;
out_destroy_part_tbl:
xa_destroy(&disk->part_tbl);
iput(disk->part0->bd_inode); // <= The same race problem exists?
out_free_bdi:
bdi_put(disk->bdi);
out_free_disk:
kfree(disk); // <= Releasing "disk" despite "disk->part0->bd_disk == disk" when bdev_free_inode() will dereference ->bd_disk after RCU.
out_put_queue:
blk_put_queue(q);
return NULL;
}
next prev parent reply other threads:[~2021-09-19 13:37 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-19 13:35 [syzbot] KASAN: use-after-free Read in bdev_free_inode syzbot
2021-09-19 13:37 ` Tetsuo Handa [this message]
2021-09-19 14:44 ` [PATCH] block: genhd: fix double kfree() in __alloc_disk_node() Tetsuo Handa
2021-09-20 6:40 ` Christoph Hellwig
2021-09-20 8:02 ` Tetsuo Handa
2021-09-20 8:05 ` Christoph Hellwig
2021-09-20 8:31 ` [PATCH v2] " Tetsuo Handa
2021-09-20 8:40 ` Christoph Hellwig
2021-10-09 4:53 ` [syzbot] KASAN: use-after-free Read in bdev_free_inode syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=41766564-08cb-e7f2-4cb2-9ad102f21324@I-love.SAKURA.ne.jp \
--to=penguin-kernel@i-love.sakura.ne.jp \
--cc=axboe@kernel.dk \
--cc=linux-block@vger.kernel.org \
--cc=syzbot+8281086e8a6fbfbd952a@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).