UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity
OpenCloudOS-Kernel/drivers/block
History
Jason Andryuk f9710c357e xen-blkfront: Handle NULL gendisk 
When a VBD is not fully created and then closed, the kernel can have a
NULL pointer dereference:

The reproducer is trivial:

[user@dom0 ~]$ sudo xl block-attach work backend=sys-usb vdev=xvdi target=/dev/sdz
[user@dom0 ~]$ xl block-list work
Vdev  BE  handle state evt-ch ring-ref BE-path
51712 0   241    4     -1     -1       /local/domain/0/backend/vbd/241/51712
51728 0   241    4     -1     -1       /local/domain/0/backend/vbd/241/51728
51744 0   241    4     -1     -1       /local/domain/0/backend/vbd/241/51744
51760 0   241    4     -1     -1       /local/domain/0/backend/vbd/241/51760
51840 3   241    3     -1     -1       /local/domain/3/backend/vbd/241/51840
                 ^ note state, the /dev/sdz doesn't exist in the backend

[user@dom0 ~]$ sudo xl block-detach work xvdi
[user@dom0 ~]$ xl block-list work
Vdev  BE  handle state evt-ch ring-ref BE-path
work is an invalid domain identifier

And its console has:

BUG: kernel NULL pointer dereference, address: 0000000000000050
PGD 80000000edebb067 P4D 80000000edebb067 PUD edec2067 PMD 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 1 PID: 52 Comm: xenwatch Not tainted 5.16.18-2.43.fc32.qubes.x86_64 #1
RIP: 0010:blk_mq_stop_hw_queues+0x5/0x40
Code: 00 48 83 e0 fd 83 c3 01 48 89 85 a8 00 00 00 41 39 5c 24 50 77 c0 5b 5d 41 5c 41 5d c3 c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 <8b> 47 50 85 c0 74 32 41 54 49 89 fc 55 53 31 db 49 8b 44 24 48 48
RSP: 0018:ffffc90000bcfe98 EFLAGS: 00010293
RAX: ffffffffc0008370 RBX: 0000000000000005 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000000
RBP: ffff88800775f000 R08: 0000000000000001 R09: ffff888006e620b8
R10: ffff888006e620b0 R11: f000000000000000 R12: ffff8880bff39000
R13: ffff8880bff39000 R14: 0000000000000000 R15: ffff88800604be00
FS:  0000000000000000(0000) GS:ffff8880f3300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000050 CR3: 00000000e932e002 CR4: 00000000003706e0
Call Trace:
 <TASK>
 blkback_changed+0x95/0x137 [xen_blkfront]
 ? read_reply+0x160/0x160
 xenwatch_thread+0xc0/0x1a0
 ? do_wait_intr_irq+0xa0/0xa0
 kthread+0x16b/0x190
 ? set_kthread_struct+0x40/0x40
 ret_from_fork+0x22/0x30
 </TASK>
Modules linked in: snd_seq_dummy snd_hrtimer snd_seq snd_seq_device snd_timer snd soundcore ipt_REJECT nf_reject_ipv4 xt_state xt_conntrack nft_counter nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat nf_tables nfnetlink intel_rapl_msr intel_rapl_common crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel xen_netfront pcspkr xen_scsiback target_core_mod xen_netback xen_privcmd xen_gntdev xen_gntalloc xen_blkback xen_evtchn ipmi_devintf ipmi_msghandler fuse bpf_preload ip_tables overlay xen_blkfront
CR2: 0000000000000050
---[ end trace 7bc9597fd06ae89d ]---
RIP: 0010:blk_mq_stop_hw_queues+0x5/0x40
Code: 00 48 83 e0 fd 83 c3 01 48 89 85 a8 00 00 00 41 39 5c 24 50 77 c0 5b 5d 41 5c 41 5d c3 c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 <8b> 47 50 85 c0 74 32 41 54 49 89 fc 55 53 31 db 49 8b 44 24 48 48
RSP: 0018:ffffc90000bcfe98 EFLAGS: 00010293
RAX: ffffffffc0008370 RBX: 0000000000000005 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000000
RBP: ffff88800775f000 R08: 0000000000000001 R09: ffff888006e620b8
R10: ffff888006e620b0 R11: f000000000000000 R12: ffff8880bff39000
R13: ffff8880bff39000 R14: 0000000000000000 R15: ffff88800604be00
FS:  0000000000000000(0000) GS:ffff8880f3300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000050 CR3: 00000000e932e002 CR4: 00000000003706e0
Kernel panic - not syncing: Fatal exception
Kernel Offset: disabled

info->rq and info->gd are only set in blkfront_connect(), which is
called for state 4 (XenbusStateConnected).  Guard against using NULL
variables in blkfront_closing() to avoid the issue.

The rest of blkfront_closing looks okay.  If info->nr_rings is 0, then
for_each_rinfo won't do anything.

blkfront_remove also needs to check for non-NULL pointers before
cleaning up the gendisk and request queue.

Fixes: 05d69d950d "xen-blkfront: sanitize the removal state machine"
Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20220601195341.28581-1-jandryuk@gmail.com
Signed-off-by: Juergen Gross <jgross@suse.com>
 		2022-06-21 16:36:09 +02:00
..
aoe aoe: Avoid flush_scheduled_work() usage 2022-05-01 06:41:41 -06:00
drbd drbd: Return true/false (not 1/0) from bool functions 2022-04-17 19:54:24 -06:00
mtip32xx mtip32xx: fix typo in comment 2022-05-21 06:32:27 -06:00
null_blk block: null_blk: Fix null_zone_write() 2022-06-02 07:11:28 -06:00
paride Char/Misc and other driver changes for 5.17-rc1 2022-01-14 16:02:28 +01:00
rnbd rnbd-srv: use bdev_discard_alignment 2022-05-03 10:38:50 -06:00
xen-blkback xen-blkback: use bdev_discard_alignment 2022-05-04 05:24:40 -06:00
zram Yang Shi has improved the behaviour of khugepaged collapsing of readonly 2022-05-26 12:32:41 -07:00
Kconfig floppy: disable FDRAWCMD by default 2022-04-27 09:41:54 -07:00
Makefile block: remove the rsxx driver 2021-12-16 10:57:04 -07:00
amiflop.c block: remove the ->rq_disk field in struct request 2021-11-29 06:41:29 -07:00
ataflop.c ataflop: use a statically allocated error counters 2022-05-08 10:01:48 -07:00
brd.c brd: remove brd_devices_mutex mutex 2022-01-17 07:19:40 -07:00
floppy.c floppy: use a statically allocated error counter 2022-05-08 10:01:48 -07:00
loop.c for-5.19/drivers-2022-06-02 2022-06-03 10:25:56 -07:00
n64cart.c n64cart: convert bi_disk to bi_bdev->bd_disk fix build 2022-03-21 06:34:45 -06:00
nbd.c nbd: use pr_err to output error message 2022-05-27 20:39:33 -06:00
pktcdvd.c for-5.19/block-2022-05-22 2022-05-23 13:56:39 -07:00
ps3disk.c ps3disk: add error handling support for add_disk() 2021-10-30 11:03:37 -06:00
ps3vram.c block: remove GENHD_FL_EXT_DEVT 2021-11-29 06:38:35 -07:00
rbd.c A big pile of assorted fixes and improvements for the filesystem with 2022-06-02 08:59:39 -07:00
rbd_types.h libceph, rbd: replace zero-length array with flexible-array 2020-06-01 13:22:53 +02:00
sunvdc.c block: remove genhd.h 2022-02-02 07:49:59 -07:00
swim.c block: remove GENHD_FL_EXT_DEVT 2021-11-29 06:38:35 -07:00
swim3.c block: remove GENHD_FL_EXT_DEVT 2021-11-29 06:38:35 -07:00
swim_asm.S treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
sx8.c blk-mq: remove the done argument to blk_execute_rq_nowait 2022-05-28 06:15:27 -06:00
virtio_blk.c virtio-blk: support mq_ops->queue_rqs() 2022-05-31 12:44:23 -04:00
xen-blkfront.c xen-blkfront: Handle NULL gendisk 2022-06-21 16:36:09 +02:00
z2ram.c block: remove GENHD_FL_EXT_DEVT 2021-11-29 06:38:35 -07:00