UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity
OpenCloudOS-Kernel/drivers
History
Coly Li 86da9f7367 bcache: fix refcount underflow in bcache_device_free() 
The problematic code piece in bcache_device_free() is,

 785 static void bcache_device_free(struct bcache_device *d)
 786 {
 787     struct gendisk *disk = d->disk;
 [snipped]
 799     if (disk) {
 800             if (disk->flags & GENHD_FL_UP)
 801                     del_gendisk(disk);
 802
 803             if (disk->queue)
 804                     blk_cleanup_queue(disk->queue);
 805
 806             ida_simple_remove(&bcache_device_idx,
 807                               first_minor_to_idx(disk->first_minor));
 808             put_disk(disk);
 809         }
 [snipped]
 816 }

At line 808, put_disk(disk) may encounter kobject refcount of 'disk'
being underflow.

Here is how to reproduce the issue,
- Attche the backing device to a cache device and do random write to
  make the cache being dirty.
- Stop the bcache device while the cache device has dirty data of the
  backing device.
- Only register the backing device back, NOT register cache device.
- The bcache device node /dev/bcache0 won't show up, because backing
  device waits for the cache device shows up for the missing dirty
  data.
- Now echo 1 into /sys/fs/bcache/pendings_cleanup, to stop the pending
  backing device.
- After the pending backing device stopped, use 'dmesg' to check kernel
  message, a use-after-free warning from KASA reported the refcount of
  kobject linked to the 'disk' is underflow.

The dropping refcount at line 808 in the above code piece is added by
add_disk(d->disk) in bch_cached_dev_run(). But in the above condition
the cache device is not registered, bch_cached_dev_run() has no chance
to be called and the refcount is not added. The put_disk() for a non-
added refcount of gendisk kobject triggers a underflow warning.

This patch checks whether GENHD_FL_UP is set in disk->flags, if it is
not set then the bcache device was not added, don't call put_disk()
and the the underflow issue can be avoided.

Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
 		2020-05-27 05:19:36 -06:00
..
accessibility
…
acpi More ACPI updates for 5.7-rc1 2020-04-10 09:52:15 -07:00
amba Revert "amba: Initialize dma_parms for amba devices" 2020-04-01 08:03:28 +02:00
android
…
ata block: move dma_pad handling from blk_rq_map_sg into the callers 2020-04-22 10:47:39 -06:00
atm .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
auxdisplay
…
base driver core: remove device_create_vargs 2020-05-09 16:15:13 -06:00
bcma
…
block block/floppy: fix contended case in floppy_queue_rq() 2020-05-26 15:23:54 -06:00
bluetooth
…
bus ARM: driver updates 2020-04-03 15:05:35 -07:00
cdrom cdrom: factor out a cdrom_multisession helper 2020-05-04 10:13:42 -06:00
char Merge branch 'akpm' (patches from Andrew) 2020-04-10 17:57:48 -07:00
clk clk: sprd: don't gate uart console clock 2020-04-13 12:20:07 -07:00
clocksource clocksource/drivers/timer-vf-pit: Add missing parenthesis 2020-04-05 09:24:58 +02:00
connector
…
counter
…
cpufreq Additional power management updates for 5.7-rc1 2020-04-06 10:14:39 -07:00
cpuidle Merge branch 'pm-cpuidle' 2020-04-10 11:32:22 +02:00
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2020-04-08 21:35:29 -07:00
dax dax: Move mandatory ->zero_page_range() check in alloc_dax() 2020-04-02 19:15:03 -07:00
dca
…
devfreq PM / devfreq: Fix handling dev_pm_qos_remove_request result 2020-03-25 08:35:03 +09:00
dio
…
dma drivers/dma/tegra20-apb-dma.c: fix platform_get_irq.cocci warnings 2020-04-10 15:36:22 -07:00
dma-buf A bunch of fixes to avoid null pointer dereference in fbcon, fix a return 2020-04-08 09:14:34 +10:00
edac Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2020-03-30 16:40:08 -07:00
eisa .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
extcon Char/Misc driver patches for 5.7-rc1 2020-04-03 13:22:40 -07:00
firewire
…
firmware efi/libstub/file: Merge file name buffers to reduce stack usage 2020-04-14 08:32:15 +02:00
fpga
…
fsi
…
gnss
…
gpio This is the bulk of GPIO development for the v5.7 kernel cycle. 2020-04-04 10:27:00 -07:00
gpu Merge branch 'linux-5.7' of git://github.com/skeggsb/linux into drm-fixes 2020-04-16 15:40:02 +10:00
greybus
…
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid 2020-04-01 15:18:42 -07:00
hsi
…
hv hyperv-fixes for 5.7-rc1 2020-04-14 11:58:04 -07:00
hwmon hwmon: (jc42) Fix name to have no illegal characters 2020-04-18 10:13:07 -07:00
hwspinlock hwspinlock: hwspinlock_internal.h: Replace zero-length array with flexible-array member 2020-03-25 22:30:46 -07:00
hwtracing intel_th: msu: Make stopping the trace optional 2020-03-24 13:45:24 +01:00
i2c i2c: tegra: Synchronize DMA before termination 2020-04-15 18:27:31 +02:00
i3c i3c: convert to use i2c_new_client_device() 2020-03-29 10:35:50 +02:00
ide ide-cd: rename cdrom_read_tocentry 2020-05-04 10:13:42 -06:00
idle Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2020-03-30 16:40:08 -07:00
iio chrome platform changes for 5.7 2020-04-08 21:25:49 -07:00
infiniband RDMA 5.7 pull request 2020-04-01 18:18:18 -07:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2020-04-07 20:20:12 -07:00
interconnect
…
iommu Merge branches 'iommu/fixes', 'arm/qcom', 'arm/omap', 'arm/smmu', 'x86/amd', 'x86/vt-d', 'virtio' and 'core' into next 2020-03-27 11:33:27 +01:00
ipack
…
irqchip Merge branch 'irq/gic-v4.1-fixes-5.7' into irq/irqchip-5.7 2020-04-17 08:59:55 +01:00
isdn mISDN: make dmril and dmrim static 2020-04-16 13:52:31 -07:00
leds leds: core: Fix warning message when init_data 2020-04-06 23:12:08 +02:00
lightnvm for-5.7/drivers-2020-03-29 2020-03-30 11:43:51 -07:00
macintosh Char/Misc driver patches for 5.7-rc1 2020-04-03 13:22:40 -07:00
mailbox
…
mcb
…
md bcache: fix refcount underflow in bcache_device_free() 2020-05-27 05:19:36 -06:00
media Power management updates for 5.7-rc1 2020-03-30 15:05:01 -07:00
memory ARM: driver updates 2020-04-03 15:05:35 -07:00
memstick
…
message scsi: message: fusion: Replace zero-length array with flexible-array member 2020-03-26 22:40:47 -04:00
mfd mfd: intel-lpss: Fix Intel Elkhart Lake LPSS I2C input clock 2020-03-30 07:35:28 +01:00
misc virtio: fixes, vdpa 2020-04-08 10:51:53 -07:00
mmc MMC core: 2020-03-31 16:13:09 -07:00
most staging: most: move core files out of the staging area 2020-03-24 13:42:44 +01:00
mtd bdi: remove the name field in struct backing_dev_info 2020-05-09 16:15:13 -06:00
mux
…
net Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-04-16 14:52:29 -07:00
nfc Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-03-25 18:58:11 -07:00
ntb pci-v5.7-changes 2020-04-03 14:25:02 -07:00
nubus
…
nvdimm libnvdimm for 5.7 2020-04-08 21:03:40 -07:00
nvme nvme: set dma alignment to qword 2020-05-27 07:12:40 +02:00
nvmem nvmem: core: remove nvmem_sysfs_get_groups() 2020-03-25 19:23:49 +01:00
of of: unittest: kmemleak in duplicate property update 2020-04-17 08:31:34 -05:00
opp opp: Manage empty OPP tables with clk handle 2020-04-13 16:14:55 +05:30
oprofile
…
parisc parisc: Replace setup_irq() by request_irq() 2020-04-05 22:05:23 +02:00
parport
…
pci IOMMU Updates for Linux v5.7 2020-04-08 11:00:00 -07:00
pcmcia pcmcia: remove some unused space characters 2020-03-31 18:48:22 +02:00
perf arm64 updates for 5.7: 2020-03-31 10:05:01 -07:00
phy pci-v5.7-changes 2020-04-03 14:25:02 -07:00
pinctrl This is the bulk of GPIO development for the v5.7 kernel cycle. 2020-04-04 10:27:00 -07:00
platform chrome-platform fixes for v5.7-rc2 2020-04-16 15:00:57 -07:00
pnp
…
power change email address for Pali Rohár 2020-04-10 15:36:22 -07:00
powercap Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2020-03-30 16:40:08 -07:00
pps
…
ps3 powerpc/ps3: Remove an unneeded NULL check 2020-04-03 00:09:59 +11:00
ptp ptp: Avoid deadlocks in the programmable pin code. 2020-03-30 11:16:38 -07:00
pwm pwm: pca9685: Fix PWM/GPIO inter-operation 2020-04-03 21:41:42 +02:00
rapidio
…
ras
…
regulator spi/regulator: Updates for v5.7 2020-03-30 14:58:26 -07:00
remoteproc remoteproc/omap: Fix set_load call in omap_rproc_request_timer 2020-04-03 10:47:21 -07:00
reset
…
rpmsg
…
rtc - New Drivers 2020-04-07 19:48:52 -07:00
s390 s390/dasd: remove ioctl_by_bdev calls 2020-05-21 08:22:20 -06:00
sbus
…
scsi lpfc: Fix return value in __lpfc_nvme_ls_abort 2020-05-27 07:12:41 +02:00
sfi
…
sh
…
siox
…
slimbus
…
soc RISC-V Patches for the 5.7 Merge Window, Part 1 2020-04-09 10:51:30 -07:00
soundwire Char/Misc driver patches for 5.7-rc1 2020-04-03 13:22:40 -07:00
spi sound updates for 5.7-rc1 2020-04-02 15:50:04 -07:00
spmi
…
ssb
…
staging mm/vma: introduce VM_ACCESS_FLAGS 2020-04-10 15:36:21 -07:00
target scsi: target: tcmu: reset_ring should reset TCMU_DEV_BIT_BROKEN 2020-04-13 14:03:20 -04:00
tc
…
tee ARM: driver updates 2020-04-03 15:05:35 -07:00
thermal - Convert tsens configuration DT binding to yaml (Rajeshwari) 2020-04-07 20:00:16 -07:00
thunderbolt
…
tty powerpc updates for 5.7 2020-04-05 11:12:59 -07:00
uio
…
usb SCSI misc on 20200402 2020-04-02 17:03:53 -07:00
vdpa vdpa: move to drivers/vdpa 2020-04-02 10:41:40 -04:00
vfio vfio: Ignore -ENODEV when getting MSI cookie 2020-04-01 13:51:51 -06:00
vhost vhost: introduce vDPA-based backend 2020-04-02 10:41:40 -04:00
video drm fixes for 5.7-rc1 2020-04-07 20:24:34 -07:00
virt
…
virtio virtio: fixes, vdpa 2020-04-08 10:51:53 -07:00
visorbus
…
vlynq
…
vme
…
w1
…
watchdog watchdog: sp805: fix restart handler 2020-04-08 11:18:38 +02:00
xen xen: branch for v5.7-rc2 2020-04-17 10:35:17 -07:00
zorro SPDX patches for 5.7-rc1. 2020-04-03 13:12:26 -07:00
Kconfig virtio: fixes, vdpa 2020-04-08 10:51:53 -07:00
Makefile virtio: fixes, vdpa 2020-04-08 10:51:53 -07:00