* [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
@ 2018-10-15 13:25 Vasilis Liaskovitis
2018-10-15 14:02 ` Roger Pau Monné
0 siblings, 1 reply; 4+ messages in thread
From: Vasilis Liaskovitis @ 2018-10-15 13:25 UTC (permalink / raw)
To: xen-devel, linux-kernel, linux-block
Cc: jgross, boris.ostrovsky, roger.pau, konrad.wilk, axboe
If a block device is hot-added when we are out of grants,
gnttab_grant_foreign_access fails with -ENOSPC (log message "28
granting access to ring page") in this code path:
talk_to_blkback ->
setup_blkring ->
xenbus_grant_ring ->
gnttab_grant_foreign_access
and the failing path in talk_to_blkback sets the driver_data to NULL:
destroy_blkring:
blkif_free(info, 0);
mutex_lock(&blkfront_mutex);
free_info(info);
mutex_unlock(&blkfront_mutex);
dev_set_drvdata(&dev->dev, NULL);
This results in a NULL pointer BUG when blkfront_remove and blkif_free
try to access the failing device's NULL struct blkfront_info.
Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com>
---
drivers/block/xen-blkfront.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 429d20131c7e..8871bf4c8a2e 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2493,6 +2493,9 @@ static int blkfront_remove(struct xenbus_device *xbdev)
dev_dbg(&xbdev->dev, "%s removed", xbdev->nodename);
+ if (!info)
+ return 0;
+
blkif_free(info, 0);
mutex_lock(&info->mutex);
--
2.19.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
2018-10-15 13:25 [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal Vasilis Liaskovitis
@ 2018-10-15 14:02 ` Roger Pau Monné
2018-10-15 14:25 ` Vasilis Liaskovitis
0 siblings, 1 reply; 4+ messages in thread
From: Roger Pau Monné @ 2018-10-15 14:02 UTC (permalink / raw)
To: Vasilis Liaskovitis
Cc: xen-devel, linux-kernel, linux-block, jgross, boris.ostrovsky,
konrad.wilk, axboe
On Mon, Oct 15, 2018 at 03:25:08PM +0200, Vasilis Liaskovitis wrote:
> If a block device is hot-added when we are out of grants,
> gnttab_grant_foreign_access fails with -ENOSPC (log message "28
> granting access to ring page") in this code path:
>
> talk_to_blkback ->
> setup_blkring ->
> xenbus_grant_ring ->
> gnttab_grant_foreign_access
>
> and the failing path in talk_to_blkback sets the driver_data to NULL:
>
> destroy_blkring:
> blkif_free(info, 0);
>
> mutex_lock(&blkfront_mutex);
> free_info(info);
> mutex_unlock(&blkfront_mutex);
>
> dev_set_drvdata(&dev->dev, NULL);
>
> This results in a NULL pointer BUG when blkfront_remove and blkif_free
> try to access the failing device's NULL struct blkfront_info.
>
> Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Thanks.
I guess this is a candidate for backporting?
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
2018-10-15 14:02 ` Roger Pau Monné
@ 2018-10-15 14:25 ` Vasilis Liaskovitis
2018-10-18 23:54 ` Konrad Rzeszutek Wilk
0 siblings, 1 reply; 4+ messages in thread
From: Vasilis Liaskovitis @ 2018-10-15 14:25 UTC (permalink / raw)
To: Roger Pau Monné
Cc: xen-devel, linux-kernel, linux-block, jgross, boris.ostrovsky,
konrad.wilk, axboe
On Mon, 2018-10-15 at 16:02 +0200, Roger Pau Monné wrote:
>
> > This results in a NULL pointer BUG when blkfront_remove and
> > blkif_free
> > try to access the failing device's NULL struct blkfront_info.
> >
> >
> I guess this is a candidate for backporting?
>
yes, I think so. At least for kernels >=4.5, which could face this
issue due to commit c31ecf6c12 (this frees the struct blkinfo in the
failing path of talk_to_blkback).
thanks,
- Vasilis
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal
2018-10-15 14:25 ` Vasilis Liaskovitis
@ 2018-10-18 23:54 ` Konrad Rzeszutek Wilk
0 siblings, 0 replies; 4+ messages in thread
From: Konrad Rzeszutek Wilk @ 2018-10-18 23:54 UTC (permalink / raw)
To: Vasilis Liaskovitis
Cc: Roger Pau Monné,
xen-devel, linux-kernel, linux-block, jgross, boris.ostrovsky,
axboe
On Mon, Oct 15, 2018 at 04:25:56PM +0200, Vasilis Liaskovitis wrote:
> On Mon, 2018-10-15 at 16:02 +0200, Roger Pau Monné wrote:
> >
> > > This results in a NULL pointer BUG when blkfront_remove and
> > > blkif_free
> > > try to access the failing device's NULL struct blkfront_info.
> > >
> > >
> > I guess this is a candidate for backporting?
> >
>
> yes, I think so. At least for kernels >=4.5, which could face this
> issue due to commit c31ecf6c12 (this frees the struct blkinfo in the
> failing path of talk_to_blkback).
OK, applied with Cc: stable@vger.kernel.org
>
> thanks,
>
> - Vasilis
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-10-18 23:54 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-10-15 13:25 [PATCH v2] xen/blkfront: avoid NULL blkfront_info dereference on device removal Vasilis Liaskovitis
2018-10-15 14:02 ` Roger Pau Monné
2018-10-15 14:25 ` Vasilis Liaskovitis
2018-10-18 23:54 ` Konrad Rzeszutek Wilk
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).