From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Yu Kuai <yukuai3@huawei.com>, Hou Tao <houtao1@huawei.com>,
Josef Bacik <josef@toxicpanda.com>, Jens Axboe <axboe@kernel.dk>,
Sasha Levin <sashal@kernel.org>,
linux-block@vger.kernel.org, nbd@other.debian.org
Subject: [PATCH AUTOSEL 5.18 57/68] nbd: fix race between nbd_alloc_config() and module removal
Date: Tue, 7 Jun 2022 13:48:23 -0400 [thread overview]
Message-ID: <20220607174846.477972-57-sashal@kernel.org> (raw)
In-Reply-To: <20220607174846.477972-1-sashal@kernel.org>
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit c55b2b983b0fa012942c3eb16384b2b722caa810 ]
When nbd module is being removing, nbd_alloc_config() may be
called concurrently by nbd_genl_connect(), although try_module_get()
will return false, but nbd_alloc_config() doesn't handle it.
The race may lead to the leak of nbd_config and its related
resources (e.g, recv_workq) and oops in nbd_read_stat() due
to the unload of nbd module as shown below:
BUG: kernel NULL pointer dereference, address: 0000000000000040
Oops: 0000 [#1] SMP PTI
CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
Workqueue: knbd16-recv recv_work [nbd]
RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]
Call Trace:
recv_work+0x3b/0xb0 [nbd]
process_one_work+0x1ed/0x390
worker_thread+0x4a/0x3d0
kthread+0x12a/0x150
ret_from_fork+0x22/0x30
Fixing it by checking the return value of try_module_get()
in nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV),
assign nbd->config only when nbd_alloc_config() succeeds to ensure
the value of nbd->config is binary (valid or NULL).
Also adding a debug message to check the reference counter
of nbd_config during module removal.
Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Link: https://lore.kernel.org/r/20220521073749.3146892-3-yukuai3@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/nbd.c | 28 +++++++++++++++++++---------
1 file changed, 19 insertions(+), 9 deletions(-)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 9dc27f9e9ddc..f26cdb51812b 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1519,15 +1519,20 @@ static struct nbd_config *nbd_alloc_config(void)
{
struct nbd_config *config;
+ if (!try_module_get(THIS_MODULE))
+ return ERR_PTR(-ENODEV);
+
config = kzalloc(sizeof(struct nbd_config), GFP_NOFS);
- if (!config)
- return NULL;
+ if (!config) {
+ module_put(THIS_MODULE);
+ return ERR_PTR(-ENOMEM);
+ }
+
atomic_set(&config->recv_threads, 0);
init_waitqueue_head(&config->recv_wq);
init_waitqueue_head(&config->conn_wait);
config->blksize_bits = NBD_DEF_BLKSIZE_BITS;
atomic_set(&config->live_connections, 0);
- try_module_get(THIS_MODULE);
return config;
}
@@ -1554,12 +1559,13 @@ static int nbd_open(struct block_device *bdev, fmode_t mode)
mutex_unlock(&nbd->config_lock);
goto out;
}
- config = nbd->config = nbd_alloc_config();
- if (!config) {
- ret = -ENOMEM;
+ config = nbd_alloc_config();
+ if (IS_ERR(config)) {
+ ret = PTR_ERR(config);
mutex_unlock(&nbd->config_lock);
goto out;
}
+ nbd->config = config;
refcount_set(&nbd->config_refs, 1);
refcount_inc(&nbd->refs);
mutex_unlock(&nbd->config_lock);
@@ -1966,13 +1972,14 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
nbd_put(nbd);
return -EINVAL;
}
- config = nbd->config = nbd_alloc_config();
- if (!nbd->config) {
+ config = nbd_alloc_config();
+ if (IS_ERR(config)) {
mutex_unlock(&nbd->config_lock);
nbd_put(nbd);
printk(KERN_ERR "nbd: couldn't allocate config\n");
- return -ENOMEM;
+ return PTR_ERR(config);
}
+ nbd->config = config;
refcount_set(&nbd->config_refs, 1);
set_bit(NBD_RT_BOUND, &config->runtime_flags);
@@ -2544,6 +2551,9 @@ static void __exit nbd_cleanup(void)
while (!list_empty(&del_list)) {
nbd = list_first_entry(&del_list, struct nbd_device, list);
list_del_init(&nbd->list);
+ if (refcount_read(&nbd->config_refs))
+ printk(KERN_ERR "nbd: possibly leaking nbd_config (ref %d)\n",
+ refcount_read(&nbd->config_refs));
if (refcount_read(&nbd->refs) != 1)
printk(KERN_ERR "nbd: possibly leaking a device\n");
nbd_put(nbd);
--
2.35.1
next prev parent reply other threads:[~2022-06-07 18:23 UTC|newest]
Thread overview: 73+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-07 17:47 [PATCH AUTOSEL 5.18 01/68] iio: dummy: iio_simple_dummy: check the return value of kstrdup() Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 02/68] staging: rtl8712: fix a potential memory leak in r871xu_drv_init() Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 03/68] iio: st_sensors: Add a local lock for protecting odr Sasha Levin
2022-06-08 9:26 ` Jonathan Cameron
2022-06-09 13:56 ` Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 04/68] lkdtm/usercopy: Expand size of "out of frame" object Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 05/68] drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback() Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 06/68] drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle() Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 07/68] drivers: staging: rtl8192eu: Fix deadlock in rtw_joinbss_event_prehandle Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 08/68] tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 09/68] tty: Fix a possible resource leak in icom_probe Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 10/68] thunderbolt: Use different lane for second DisplayPort tunnel Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 11/68] drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 12/68] drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 13/68] USB: host: isp116x: check return value after calling platform_get_resource() Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 14/68] drivers: tty: serial: Fix deadlock in sa1100_set_termios() Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 15/68] drivers: usb: host: Fix deadlock in oxu_bus_suspend() Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 16/68] USB: hcd-pci: Fully suspend across freeze/thaw cycle Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 17/68] char: xillybus: fix a refcount leak in cleanup_dev() Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 18/68] sysrq: do not omit current cpu when showing backtrace of all active CPUs Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 19/68] usb: dwc2: gadget: don't reset gadget's driver->bus Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 20/68] usb: dwc3: host: Stop setting the ACPI companion Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 21/68] usb: dwc3: gadget: Only End Transfer for ep0 data phase Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 22/68] soundwire: qcom: adjust autoenumeration timeout Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 23/68] misc: rtsx: set NULL intfdata when probe fails Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 24/68] extcon: Fix extcon_get_extcon_dev() error handling Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 25/68] extcon: Modify extcon device to be created after driver data is set Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 26/68] clocksource/drivers/sp804: Avoid error on multiple instances Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 27/68] staging: rtl8723bs: Fix alignment to match open parenthesis Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 28/68] staging: rtl8712: fix uninit-value in usb_read8() and friends Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 29/68] staging: rtl8712: fix uninit-value in r871xu_drv_init() Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 30/68] serial: msm_serial: disable interrupts in __msm_console_write() Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 31/68] accessiblity: speakup: Add missing misc_deregister in softsynth_probe Sasha Levin
2022-06-09 12:28 ` Samuel Thibault
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 32/68] kernfs: Separate kernfs_pr_cont_buf and rename_lock Sasha Levin
2022-06-07 17:47 ` [PATCH AUTOSEL 5.18 33/68] watchdog: wdat_wdt: Stop watchdog when rebooting the system Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 34/68] ksmbd: smbd: fix connection dropped issue Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 35/68] md: don't unregister sync_thread with reconfig_mutex held Sasha Levin
2022-06-08 8:43 ` [dm-devel] " Guoqing Jiang
2022-06-12 17:53 ` Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 36/68] md: protect md_unregister_thread from reentrancy Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 37/68] ASoC: SOF: amd: Fixed Build error Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 38/68] scsi: myrb: Fix up null pointer access on myrb_cleanup() Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 39/68] ASoC: rt5640: Do not manipulate pin "Platform Clock" if the "Platform Clock" is not in the DAPM Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 40/68] Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 41/68] ceph: allow ceph.dir.rctime xattr to be updatable Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 42/68] ceph: flush the mdlog for filesystem sync Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 43/68] ceph: fix possible deadlock when holding Fwb to get inline_data Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 44/68] net, neigh: Set lower cap for neigh_managed_work rearming Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 45/68] drm/amd/display: Check if modulo is 0 before dividing Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 46/68] drm/amd/display: Check zero planes for OTG disable W/A on clock change Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 47/68] drm/radeon: fix a possible null pointer dereference Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 48/68] drm/amd/pm: fix a potential gpu_metrics_table memory leak Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 49/68] drm/amd/pm: Fix missing thermal throttler status Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 50/68] drm/amd/pm: correct the metrics version for SMU 11.0.11/12/13 Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 51/68] um: line: Use separate IRQs per line Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 52/68] modpost: fix undefined behavior of is_arm_mapping_symbol() Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 53/68] objtool: Mark __ubsan_handle_builtin_unreachable() as noreturn Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 54/68] x86/cpu: Elide KCSAN for cpu_has() and friends Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 55/68] jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 56/68] nbd: call genl_unregister_family() first in nbd_cleanup() Sasha Levin
2022-06-07 17:48 ` Sasha Levin [this message]
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 58/68] nbd: fix io hung while disconnecting device Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 59/68] fs/ntfs3: Fix invalid free in log_replay Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 60/68] Revert "PCI: brcmstb: Do not turn off WOL regulators on suspend" Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 61/68] Revert "PCI: brcmstb: Add control of subdevice voltage regulators" Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 62/68] Revert "PCI: brcmstb: Add mechanism to turn on subdev regulators" Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 63/68] Revert "PCI: brcmstb: Split brcm_pcie_setup() into two funcs" Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 64/68] cifs: fix potential deadlock in direct reclaim Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 65/68] s390/gmap: voluntarily schedule during key setting Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 66/68] cifs: version operations for smb20 unneeded when legacy support disabled Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 67/68] drm/amd/pm: use bitmap_{from,to}_arr32 where appropriate Sasha Levin
2022-06-07 17:48 ` [PATCH AUTOSEL 5.18 68/68] nodemask: Fix return values to be unsigned Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220607174846.477972-57-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=axboe@kernel.dk \
--cc=houtao1@huawei.com \
--cc=josef@toxicpanda.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nbd@other.debian.org \
--cc=stable@vger.kernel.org \
--cc=yukuai3@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).