github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-04 20:46:48 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
8542870237
linux/drivers/md
History
Yu Kuai 8542870237 md: fix mddev uaf while iterating all_mddevs list 
While iterating all_mddevs list from md_notify_reboot() and md_exit(),
list_for_each_entry_safe is used, and this can race with deletint the
next mddev, causing UAF:

t1:
spin_lock
//list_for_each_entry_safe(mddev, n, ...)
 mddev_get(mddev1)
 // assume mddev2 is the next entry
 spin_unlock
            t2:
            //remove mddev2
            ...
            mddev_free
            spin_lock
            list_del
            spin_unlock
            kfree(mddev2)
 mddev_put(mddev1)
 spin_lock
 //continue dereference mddev2->all_mddevs

The old helper for_each_mddev() actually grab the reference of mddev2
while holding the lock, to prevent from being freed. This problem can be
fixed the same way, however, the code will be complex.

Hence switch to use list_for_each_entry, in this case mddev_put() can free
the mddev1 and it's not safe as well. Refer to md_seq_show(), also factor
out a helper mddev_put_locked() to fix this problem.

Cc: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/linux-raid/20250220124348.845222-1-yukuai1@huaweicloud.com
Fixes: f265143422 ("md: stop using for_each_mddev in md_notify_reboot")
Fixes: 16648bac86 ("md: stop using for_each_mddev in md_exit")
Reported-and-tested-by: Guillaume Morin <guillaume@morinfr.org>
Closes: https://lore.kernel.org/all/Z7Y0SURoA8xwg7vn@bender.morinfr.org/
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
2025-03-05 00:29:41 +08:00
..
bcache block: Delete bio_set_prio() 2024-12-23 08:17:23 -07:00
dm-vdo - Dm: remove unused functions and variables 2024-11-25 18:54:00 -08:00
persistent-data - fix a spelling error in dm-raid 2025-01-27 17:06:42 -08:00
dm-audit.c
dm-audit.h
dm-bio-prison-v1.c dm cache: Remove unused functions in bio-prison-v1 2024-11-20 11:38:04 +01:00
dm-bio-prison-v1.h dm cache: Remove unused functions in bio-prison-v1 2024-11-20 11:38:04 +01:00
dm-bio-prison-v2.c dm: use bio_list_merge_init 2024-04-01 11:53:37 -06:00
dm-bio-prison-v2.h
dm-bio-record.h
dm-bufio.c dm-bufio: use kmalloc to allocate power-of-two sized buffers 2024-11-20 11:44:23 +01:00
dm-builtin.c
dm-cache-background-tracker.c dm cache: Remove unused btracker_nr_writebacks_queued 2024-11-20 11:38:04 +01:00
dm-cache-background-tracker.h dm cache: Remove unused btracker_nr_writebacks_queued 2024-11-20 11:38:04 +01:00
dm-cache-block-types.h
dm-cache-metadata.c dm cache: Remove unused dm_cache_size 2024-11-20 11:38:04 +01:00
dm-cache-metadata.h dm cache: Remove unused dm_cache_size 2024-11-20 11:38:04 +01:00
dm-cache-policy-internal.h
dm-cache-policy-smq.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-cache-policy.c
dm-cache-policy.h
dm-cache-target.c for-6.13/block-20241118 2024-11-18 16:50:08 -08:00
dm-clone-metadata.c dm: Make use of __assign_bit() API 2024-09-02 16:53:53 +02:00
dm-clone-metadata.h
dm-clone-target.c block: add a bdev_limits helper 2024-10-29 09:15:00 -06:00
dm-core.h dm: optimize flushes 2024-06-26 11:32:39 -04:00
dm-crypt.c dm-crypt: track tag_offset in convert_context 2025-01-21 22:02:12 +01:00
dm-delay.c dm-delay: remove timer_lock 2024-05-09 09:10:58 -04:00
dm-dust.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-ebs-target.c dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY 2025-01-08 15:28:47 +01:00
dm-era-target.c dm: Constify struct dm_block_validator 2024-07-19 12:08:15 +02:00
dm-exception-store.c
dm-exception-store.h
dm-flakey.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-ima.c
dm-ima.h
dm-init.c dm init: Handle minors larger than 255 2024-07-02 20:53:41 +02:00
dm-integrity.c - Misc VDO fixes 2024-09-27 09:12:51 -07:00
dm-io-rewind.c
dm-io-tracker.h
dm-io.c dm-io: Warn on creating multiple atomic write bios for a region 2025-01-17 22:24:09 +01:00
dm-ioctl.c dm ioctl: rate limit a couple of ioctl based error messages 2024-11-20 11:38:04 +01:00
dm-kcopyd.c dm io: Support IO priority 2024-02-20 14:22:51 -05:00
dm-linear.c dm-linear: Enable atomic writes 2025-01-17 22:24:04 +01:00
dm-log-userspace-base.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-log-userspace-transfer.c
dm-log-userspace-transfer.h
dm-log-writes.c dm: always manage discard support in terms of max_hw_discard_sectors 2024-05-20 15:51:19 -04:00
dm-log.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-mpath.c dm mpath: don't call dm_get_device in multipath_message 2024-07-10 13:10:06 +02:00
dm-mpath.h
dm-path-selector.c
dm-path-selector.h
dm-ps-historical-service-time.c
dm-ps-io-affinity.c dm: change kzalloc to kcalloc 2025-01-17 22:05:39 +01:00
dm-ps-queue-length.c
dm-ps-round-robin.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-ps-service-time.c
dm-raid.c dm raid: fix spelling errors in raid_ctr() 2025-01-17 22:05:39 +01:00
dm-raid1.c dm-mirror: Support atomic writes 2025-01-17 22:24:11 +01:00
dm-region-hash.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-rq.c block: remove BLK_MQ_F_SHOULD_MERGE 2024-12-23 08:17:23 -07:00
dm-rq.h
dm-snap-persistent.c dm io: Support IO priority 2024-02-20 14:22:51 -05:00
dm-snap-transient.c
dm-snap.c dm: always manage discard support in terms of max_hw_discard_sectors 2024-05-20 15:51:19 -04:00
dm-stats.c dm stats: limit the number of entries 2024-01-30 14:06:44 -05:00
dm-stats.h
dm-stripe.c dm-stripe: Enable atomic writes 2025-01-17 22:24:06 +01:00
dm-switch.c
dm-sysfs.c
dm-table.c blk-crypto: add basic hardware-wrapped key support 2025-02-10 09:54:19 -07:00
dm-target.c dm: always manage discard support in terms of max_hw_discard_sectors 2024-05-20 15:51:19 -04:00
dm-thin-metadata.c dm: Constify struct dm_block_validator 2024-07-19 12:08:15 +02:00
dm-thin-metadata.h
dm-thin.c - dm-array fixes 2025-01-08 10:12:01 -08:00
dm-uevent.c
dm-uevent.h
dm-unstripe.c dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow 2024-11-04 17:34:56 +01:00
dm-verity-fec.c for-6.14/block-20250118 2025-01-20 19:38:46 -08:00
dm-verity-fec.h dm-verity: always "map" the data blocks 2024-07-03 21:41:11 +02:00
dm-verity-loadpin.c
dm-verity-target.c block: Delete bio_prio() 2024-12-23 08:17:22 -07:00
dm-verity-verify-sig.c dm verity: fallback to platform keyring also if key in trusted keyring is rejected 2024-09-26 17:27:08 +02:00
dm-verity-verify-sig.h
dm-verity.h dm-verity: remove the unused "data_start" variable 2024-11-20 11:44:44 +01:00
dm-writecache.c dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list 2024-02-20 14:22:55 -05:00
dm-zero.c dm: always manage discard support in terms of max_hw_discard_sectors 2024-05-20 15:51:19 -04:00
dm-zone.c block: pre-calculate max_zone_append_sectors 2024-11-11 09:20:36 -07:00
dm-zoned-metadata.c dm: zoned: Remove unused functions 2024-11-20 11:38:04 +01:00
dm-zoned-reclaim.c dm: Fix dm-zoned-reclaim zone write pointer alignment 2024-12-10 09:15:33 -07:00
dm-zoned-target.c dm: stop using blk_limits_io_{min,opt} 2024-07-10 13:10:06 +02:00
dm-zoned.h dm: zoned: Remove unused functions 2024-11-20 11:38:04 +01:00
dm.c dm: Ensure cloned bio is same length for atomic write 2025-01-17 22:24:01 +01:00
dm.h dm: Remove unused dm_table_bio_based 2024-11-20 11:38:04 +01:00
Kconfig md: reintroduce md-linear 2025-01-13 07:36:29 -08:00
Makefile md: reintroduce md-linear 2025-01-13 07:36:29 -08:00
md-autodetect.c md: reintroduce md-linear 2025-01-13 07:36:29 -08:00
md-bitmap.c md: don't export md_cluster_ops 2025-03-05 00:28:17 +08:00
md-bitmap.h md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() 2025-01-13 08:56:10 -08:00
md-cluster.c md: switch md-cluster to use md_submodle_head 2025-03-05 00:28:39 +08:00
md-cluster.h md: switch md-cluster to use md_submodle_head 2025-03-05 00:28:39 +08:00
md-linear.c md: switch personalities to use md_submodule_head 2025-03-05 00:27:20 +08:00
md.c md: fix mddev uaf while iterating all_mddevs list 2025-03-05 00:29:41 +08:00
md.h md: switch md-cluster to use md_submodle_head 2025-03-05 00:28:39 +08:00
raid1-10.c md: don't export md_cluster_ops 2025-03-05 00:28:17 +08:00
raid1.c md: don't export md_cluster_ops 2025-03-05 00:28:17 +08:00
raid1.h md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() 2025-01-13 08:56:10 -08:00
raid5-cache.c md/md-bitmap: move bitmap_{start, end}write to md upper layer 2025-01-13 08:56:11 -08:00
raid5-log.h
raid5-ppl.c md/raid5-ppl: Use atomic64_inc_return() in ppl_new_iounit() 2024-11-05 16:08:38 -08:00
raid5.c md: switch personalities to use md_submodule_head 2025-03-05 00:27:20 +08:00
raid5.h md/md-bitmap: move bitmap_{start, end}write to md upper layer 2025-01-13 08:56:11 -08:00
raid10.c md: don't export md_cluster_ops 2025-03-05 00:28:17 +08:00
raid10.h md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() 2025-01-13 08:56:10 -08:00
raid0.c md: switch personalities to use md_submodule_head 2025-03-05 00:27:20 +08:00
raid0.h