Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1644519
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.18 37/49] sg: Fix double-free when drives detach during SG_IO |
| Date | 2017-05-18 15:30 +0200 |
| Message-ID | <tItF9-37o-51@gated-at.bofh.it> (permalink) |
| References | <tItvr-33n-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Calvin Owens <calvinowens@fb.com>
commit f3951a3709ff50990bf3e188c27d346792103432 upstream.
In sg_common_write(), we free the block request and return -ENODEV if
the device is detached in the middle of the SG_IO ioctl().
Unfortunately, sg_finish_rem_req() also tries to free srp->rq, so we
end up freeing rq->cmd in the already free rq object, and then free
the object itself out from under the current user.
This ends up corrupting random memory via the list_head on the rq
object. The most common crash trace I saw is this:
------------[ cut here ]------------
kernel BUG at block/blk-core.c:1420!
Call Trace:
[<ffffffff81281eab>] blk_put_request+0x5b/0x80
[<ffffffffa0069e5b>] sg_finish_rem_req+0x6b/0x120 [sg]
[<ffffffffa006bcb9>] sg_common_write.isra.14+0x459/0x5a0 [sg]
[<ffffffff8125b328>] ? selinux_file_alloc_security+0x48/0x70
[<ffffffffa006bf95>] sg_new_write.isra.17+0x195/0x2d0 [sg]
[<ffffffffa006cef4>] sg_ioctl+0x644/0xdb0 [sg]
[<ffffffff81170f80>] do_vfs_ioctl+0x90/0x520
[<ffffffff81258967>] ? file_has_perm+0x97/0xb0
[<ffffffff811714a1>] SyS_ioctl+0x91/0xb0
[<ffffffff81602afb>] tracesys+0xdd/0xe2
RIP [<ffffffff81281e04>] __blk_put_request+0x154/0x1a0
The solution is straightforward: just set srp->rq to NULL in the
failure branch so that sg_finish_rem_req() doesn't attempt to re-free
it.
Additionally, since sg_rq_end_io() will never be called on the object
when this happens, we need to free memory backing ->cmd if it isn't
embedded in the object itself.
KASAN was extremely helpful in finding the root cause of this bug.
Signed-off-by: Calvin Owens <calvinowens@fb.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/sg.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -791,8 +791,14 @@ sg_common_write(Sg_fd * sfp, Sg_request
return k; /* probably out of space --> ENOMEM */
}
if (atomic_read(&sdp->detaching)) {
- if (srp->bio)
+ if (srp->bio) {
+ if (srp->rq->cmd != srp->rq->__cmd)
+ kfree(srp->rq->cmd);
+
blk_end_request_all(srp->rq, -EIO);
+ srp->rq = NULL;
+ }
+
sg_finish_rem_req(srp);
return -ENODEV;
}
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.18 00/49] 3.18.54-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200 [PATCH 3.18 22/49] SMB3: Work around mount failure when using SMB3 dialect to Macs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200 [PATCH 3.18 01/49] target/fileio: Fix zero-length READ and WRITE handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200 [PATCH 3.18 41/49] ppp: defer netns reference release for ppp channel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200 [PATCH 3.18 09/49] staging: comedi: jr3_pci: cope with jiffies wraparound Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200 [PATCH 3.18 31/49] perf: Fix event->ctx locking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200 [PATCH 3.18 11/49] usb: hub: Do not attempt to autosuspend disconnected devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200 [PATCH 3.18 07/49] staging: gdm724x: gdm_mux: fix use-after-free on module unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200 [PATCH 3.18 44/49] sched: panic on corrupted stack end Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200 [PATCH 3.18 06/49] staging: vt6656: use off stack for out buffer USB transfers. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200 [PATCH 3.18 08/49] staging: comedi: jr3_pci: fix possible null pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 32/49] arm64: perf: reject groups spanning multiple HW PMUs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 42/49] HID: core: prevent out-of-bound readings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 05/49] staging: vt6656: use off stack for in buffer USB transfers. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 04/49] USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 17/49] IB/mlx4: Fix ib device initialization error flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 39/49] ipv6: sctp: fix lockdep splat in sctp_v6_get_dst() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 33/49] perf: Fix race in swevent hash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 26/49] md/raid1: avoid reusing a resync bio after error handling. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 38/49] ipv6: sctp: add rcu protection around np->opt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 29/49] Bluetooth: Fix user channel for 32bit userspace on 64bit kernel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 37/49] sg: Fix double-free when drives detach during SG_IO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 36/49] ext4: fix potential use after free in __ext4_journal_stop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 18/49] fs/xattr.c: zero out memory copied to userspace in getxattr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 03/49] USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 34/49] ASN.1: Fix non-match detection failure on data overrun Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 21/49] Set unicode flag on cifs echo request to avoid Mac error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 45/49] ALSA: seq: Fix race at timer setup and close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 30/49] arm64: make sys_call_table const Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 25/49] padata: free correct variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 28/49] serial: omap: suspend device on probe errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 40/49] af_unix: Guard against other == sk in unix_dgram_sendmsg Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200 [PATCH 3.18 02/49] usb: host: xhci: print correct command ring address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200 [PATCH 3.18 12/49] usb: misc: legousbtower: Fix buffers on stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200 [PATCH 3.18 20/49] fs/block_dev: always invalidate cleancache in invalidate_bdev() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200 [PATCH 3.18 16/49] IB/IPoIB: ibX: failed to create mcg debug file Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200 [PATCH 3.18 14/49] um: Fix PTRACE_POKEUSER on x86_64 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200 Re: [PATCH 3.18 00/49] 3.18.54-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-05-18 19:30 +0200 Re: [PATCH 3.18 00/49] 3.18.54-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-19 03:10 +0200
csiph-web