From: linan666@huaweicloud.com
To: josef@toxicpanda.com, axboe@kernel.dk
Cc: linux-block@vger.kernel.org, nbd@other.debian.org,
linux-kernel@vger.kernel.org, linan122@huawei.com,
yukuai3@huawei.com, yi.zhang@huawei.com, houtao1@huawei.com,
yangerkun@huawei.com
Subject: [PATCH 3/3] nbd: fix null-ptr-dereference while accessing 'nbd->config'
Date: Fri, 17 Nov 2023 00:23:16 +0800 [thread overview]
Message-ID: <20231116162316.1740402-4-linan666@huaweicloud.com> (raw)
In-Reply-To: <20231116162316.1740402-1-linan666@huaweicloud.com>
From: Li Nan <linan122@huawei.com>
Memory reordering may occur in nbd_genl_connect(), causing config_refs
to be set to 1 while nbd->config is still empty. Opening nbd at this
time will cause null-ptr-dereference.
T1 T2
nbd_open
nbd_get_config_unlocked
nbd_genl_connect
nbd_alloc_and_init_config
//memory reordered
refcount_set(&nbd->config_refs, 1) // 2
nbd->config
->null point
nbd->config = config // 1
Fix it by adding smp barrier to guarantee the execution sequence.
Signed-off-by: Li Nan <linan122@huawei.com>
---
drivers/block/nbd.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 1b9ee96d3b8a..03f387f1abb5 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -398,8 +398,16 @@ static u32 req_to_nbd_cmd_type(struct request *req)
static struct nbd_config *nbd_get_config_unlocked(struct nbd_device *nbd)
{
- if (refcount_inc_not_zero(&nbd->config_refs))
+ if (refcount_inc_not_zero(&nbd->config_refs)) {
+ /*
+ * Add smp_mb__after_atomic to ensure that reading nbd->config_refs
+ * and reading nbd->config is ordered. The pair is the barrier in
+ * nbd_alloc_and_init_config(), avoid nbd->config_refs is set
+ * before nbd->config.
+ */
+ smp_mb__after_atomic();
return nbd->config;
+ }
return NULL;
}
@@ -1559,7 +1567,15 @@ static int nbd_alloc_and_init_config(struct nbd_device *nbd)
init_waitqueue_head(&config->conn_wait);
config->blksize_bits = NBD_DEF_BLKSIZE_BITS;
atomic_set(&config->live_connections, 0);
+
nbd->config = config;
+ /*
+ * Order refcount_set(&nbd->config_refs, 1) and nbd->config assignment,
+ * its pair is the barrier in nbd_get_config_unlocked().
+ * So nbd_get_config_unlocked() won't see nbd->config as null after
+ * refcount_inc_not_zero() succeed.
+ */
+ smp_mb__before_atomic();
refcount_set(&nbd->config_refs, 1);
return 0;
--
2.39.2
next prev parent reply other threads:[~2023-11-16 8:29 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-16 16:23 [PATCH 0/3] fix null-ptr-deref in nbd_open() linan666
2023-11-16 16:23 ` [PATCH 1/3] nbd: fold nbd config initialization into nbd_alloc_config() linan666
2023-11-16 16:23 ` [PATCH 2/3] nbd: factor out a helper to get nbd_config without holding 'config_lock' linan666
2023-11-16 16:23 ` linan666 [this message]
2023-11-20 17:08 ` [PATCH 0/3] fix null-ptr-deref in nbd_open() Josef Bacik
2023-11-20 17:16 ` Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231116162316.1740402-4-linan666@huaweicloud.com \
--to=linan666@huaweicloud.com \
--cc=axboe@kernel.dk \
--cc=houtao1@huawei.com \
--cc=josef@toxicpanda.com \
--cc=linan122@huawei.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nbd@other.debian.org \
--cc=yangerkun@huawei.com \
--cc=yi.zhang@huawei.com \
--cc=yukuai3@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.