From patchwork Thu Oct 20 13:20:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu Kuai X-Patchwork-Id: 13013426 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 04AFAC4332F for ; Thu, 20 Oct 2022 12:59:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230188AbiJTM66 (ORCPT ); Thu, 20 Oct 2022 08:58:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52376 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229679AbiJTM64 (ORCPT ); Thu, 20 Oct 2022 08:58:56 -0400 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 253521CCCC2; Thu, 20 Oct 2022 05:58:53 -0700 (PDT) Received: from dggemv704-chm.china.huawei.com (unknown [172.30.72.53]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4MtSMl4CnJzHv5y; Thu, 20 Oct 2022 20:58:43 +0800 (CST) Received: from kwepemm600009.china.huawei.com (7.193.23.164) by dggemv704-chm.china.huawei.com (10.3.19.47) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Thu, 20 Oct 2022 20:58:49 +0800 Received: from huawei.com (10.175.127.227) by kwepemm600009.china.huawei.com (7.193.23.164) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Thu, 20 Oct 2022 20:58:48 +0800 From: Yu Kuai To: , , , , , , , CC: , , , Subject: [PATCH -nect RFC v2 1/2] block: add helpers for bd_holder_dir refcount management Date: Thu, 20 Oct 2022 21:20:48 +0800 Message-ID: <20221020132049.3947415-2-yukuai3@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221020132049.3947415-1-yukuai3@huawei.com> References: <20221020132049.3947415-1-yukuai3@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.175.127.227] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To kwepemm600009.china.huawei.com (7.193.23.164) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org Currently the lifecycle of bd_holder_dir is problematic, it can be freed in del_gendisk() while it can still be accessed before disk_release(). And there in no way to know if the kobject if freed by kobject_put() for now, thus add a new field in bloce_device to manage refcount of bd_holder_dir seperately. Prepare to fix the problem in following patch. Signed-off-by: Yu Kuai --- block/blk.h | 3 +++ block/genhd.c | 27 +++++++++++++++++++++++++++ include/linux/blk_types.h | 1 + 3 files changed, 31 insertions(+) diff --git a/block/blk.h b/block/blk.h index d6ea0d1a6db0..fef868b4169c 100644 --- a/block/blk.h +++ b/block/blk.h @@ -458,6 +458,9 @@ extern const struct address_space_operations def_blk_aops; int disk_register_independent_access_ranges(struct gendisk *disk); void disk_unregister_independent_access_ranges(struct gendisk *disk); +bool bd_try_get_holder_dir(struct block_device *bdev); +void bd_put_holder_dir(struct block_device *bdev); + #ifdef CONFIG_FAIL_MAKE_REQUEST bool should_fail_request(struct block_device *part, unsigned int bytes); #else /* CONFIG_FAIL_MAKE_REQUEST */ diff --git a/block/genhd.c b/block/genhd.c index 17b33c62423d..53f9c8b2690a 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -375,6 +375,33 @@ int disk_scan_partitions(struct gendisk *disk, fmode_t mode) return 0; } +bool bd_try_get_holder_dir(struct block_device *bdev) +{ + mutex_lock(&bdev->bd_disk->open_mutex); + if (!bdev->holder_dir_ref) { + mutex_unlock(&bdev->bd_disk->open_mutex); + return false; + } + + bdev->holder_dir_ref++; + mutex_unlock(&bdev->bd_disk->open_mutex); + return true; +} + +void bd_put_holder_dir(struct block_device *bdev) +{ + mutex_lock(&bdev->bd_disk->open_mutex); + if (WARN_ON(bdev->holder_dir_ref <= 0)) + goto out; + + if (!(--bdev->holder_dir_ref)) { + kobject_put(bdev->bd_holder_dir); + bdev->bd_holder_dir = NULL; + } +out: + mutex_unlock(&bdev->bd_disk->open_mutex); +} + /** * device_add_disk - add disk information to kernel list * @parent: parent device for the disk diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h index e0b098089ef2..550c8e15af49 100644 --- a/include/linux/blk_types.h +++ b/include/linux/blk_types.h @@ -53,6 +53,7 @@ struct block_device { int bd_holders; bool bd_write_holder; struct kobject *bd_holder_dir; + int holder_dir_ref; u8 bd_partno; spinlock_t bd_size_lock; /* for bd_inode->i_size updates */ struct gendisk * bd_disk; From patchwork Thu Oct 20 13:20:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu Kuai X-Patchwork-Id: 13013427 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 388C0C4332F for ; Thu, 20 Oct 2022 12:59:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229800AbiJTM7K (ORCPT ); Thu, 20 Oct 2022 08:59:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230308AbiJTM7B (ORCPT ); Thu, 20 Oct 2022 08:59:01 -0400 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CFC5A127937; Thu, 20 Oct 2022 05:58:57 -0700 (PDT) Received: from dggemv703-chm.china.huawei.com (unknown [172.30.72.53]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4MtSGd0RY8zVj1y; Thu, 20 Oct 2022 20:54:17 +0800 (CST) Received: from kwepemm600009.china.huawei.com (7.193.23.164) by dggemv703-chm.china.huawei.com (10.3.19.46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Thu, 20 Oct 2022 20:58:50 +0800 Received: from huawei.com (10.175.127.227) by kwepemm600009.china.huawei.com (7.193.23.164) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Thu, 20 Oct 2022 20:58:49 +0800 From: Yu Kuai To: , , , , , , , CC: , , , Subject: [PATCH -nect RFC v2 2/2] block: fix uaf for bd_holder_dir Date: Thu, 20 Oct 2022 21:20:49 +0800 Message-ID: <20221020132049.3947415-3-yukuai3@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221020132049.3947415-1-yukuai3@huawei.com> References: <20221020132049.3947415-1-yukuai3@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.175.127.227] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To kwepemm600009.china.huawei.com (7.193.23.164) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org Lifecycle of bd_holder_dir is problematic: t1: t2: // get bdev of lower disk blkdev_get_by_dev // remove lower disk del_gendisk // initial reference is released, and // bd_holder_dir can be freed kobject_put // uaf is triggered bd_link_disk_holder Fix the problem by protecting bd_holder_dir by open_mutex. Signed-off-by: Yu Kuai --- block/genhd.c | 6 +++++- block/holder.c | 19 +++++++++++++------ block/partitions/core.c | 5 ++++- 3 files changed, 22 insertions(+), 8 deletions(-) diff --git a/block/genhd.c b/block/genhd.c index 53f9c8b2690a..b3d04e79e854 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -499,6 +499,8 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk, ret = -ENOMEM; goto out_del_integrity; } + disk->part0->holder_dir_ref = 1; + disk->slave_dir = kobject_create_and_add("slaves", &ddev->kobj); if (!disk->slave_dir) { ret = -ENOMEM; @@ -557,6 +559,8 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk, kobject_put(disk->slave_dir); out_put_holder_dir: kobject_put(disk->part0->bd_holder_dir); + disk->part0->bd_holder_dir = NULL; + disk->part0->holder_dir_ref = 0; out_del_integrity: blk_integrity_del(disk); out_del_block_link: @@ -649,7 +653,7 @@ void del_gendisk(struct gendisk *disk) blk_unregister_queue(disk); - kobject_put(disk->part0->bd_holder_dir); + bd_put_holder_dir(disk->part0); kobject_put(disk->slave_dir); part_stat_set_all(disk->part0, 0); diff --git a/block/holder.c b/block/holder.c index 5283bc804cc1..2e28b472ba1a 100644 --- a/block/holder.c +++ b/block/holder.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only #include #include +#include "blk.h" struct bd_holder_disk { struct list_head list; @@ -85,9 +86,19 @@ int bd_link_disk_holder(struct block_device *bdev, struct gendisk *disk) goto out_unlock; } + /* + * del_gendisk drops the initial reference to bd_holder_dir, so we need + * to keep our own here to allow for cleanup past that point. + */ + if (!bd_try_get_holder_dir(bdev)) { + ret = -ENODEV; + goto out_unlock; + } + holder = kzalloc(sizeof(*holder), GFP_KERNEL); if (!holder) { ret = -ENOMEM; + bd_put_holder_dir(bdev); goto out_unlock; } @@ -98,16 +109,12 @@ int bd_link_disk_holder(struct block_device *bdev, struct gendisk *disk) ret = __link_disk_holder(bdev, disk); if (ret) { kfree(holder); + bd_put_holder_dir(bdev); goto out_unlock; } } list_add(&holder->list, &disk->slave_bdevs); - /* - * del_gendisk drops the initial reference to bd_holder_dir, so we need - * to keep our own here to allow for cleanup past that point. - */ - kobject_get(bdev->bd_holder_dir); out_unlock: mutex_unlock(&disk->open_mutex); @@ -141,7 +148,7 @@ void bd_unlink_disk_holder(struct block_device *bdev, struct gendisk *disk) if (!WARN_ON_ONCE(holder == NULL) && !--holder->refcnt) { if (disk->slave_dir) __unlink_disk_holder(bdev, disk); - kobject_put(bdev->bd_holder_dir); + bd_put_holder_dir(bdev); list_del_init(&holder->list); kfree(holder); } diff --git a/block/partitions/core.c b/block/partitions/core.c index b8112f52d388..39a14f7c308e 100644 --- a/block/partitions/core.c +++ b/block/partitions/core.c @@ -279,7 +279,7 @@ static void delete_partition(struct block_device *part) __invalidate_device(part, true); xa_erase(&part->bd_disk->part_tbl, part->bd_partno); - kobject_put(part->bd_holder_dir); + bd_put_holder_dir(part); device_del(&part->bd_device); /* @@ -390,6 +390,7 @@ static struct block_device *add_partition(struct gendisk *disk, int partno, bdev->bd_holder_dir = kobject_create_and_add("holders", &pdev->kobj); if (!bdev->bd_holder_dir) goto out_del; + bdev->holder_dir_ref = 1; dev_set_uevent_suppress(pdev, 0); if (flags & ADDPART_FLAG_WHOLEDISK) { @@ -411,6 +412,8 @@ static struct block_device *add_partition(struct gendisk *disk, int partno, out_del: kobject_put(bdev->bd_holder_dir); + bdev->bd_holder_dir = NULL; + bdev->holder_dir_ref = 0; device_del(pdev); out_put: put_device(pdev);