linux/kernel
Cengiz Can 8278223554 blktrace: fix dereference after null check
[ Upstream commit 153031a301 ]

There was a recent change in blktrace.c that added a RCU protection to
`q->blk_trace` in order to fix a use-after-free issue during access.

However the change missed an edge case that can lead to dereferencing of
`bt` pointer even when it's NULL:

Coverity static analyzer marked this as a FORWARD_NULL issue with CID
1460458.

```
/kernel/trace/blktrace.c: 1904 in sysfs_blk_trace_attr_store()
1898            ret = 0;
1899            if (bt == NULL)
1900                    ret = blk_trace_setup_queue(q, bdev);
1901
1902            if (ret == 0) {
1903                    if (attr == &dev_attr_act_mask)
>>>     CID 1460458:  Null pointer dereferences  (FORWARD_NULL)
>>>     Dereferencing null pointer "bt".
1904                            bt->act_mask = value;
1905                    else if (attr == &dev_attr_pid)
1906                            bt->pid = value;
1907                    else if (attr == &dev_attr_start_lba)
1908                            bt->start_lba = value;
1909                    else if (attr == &dev_attr_end_lba)
```

Added a reassignment with RCU annotation to fix the issue.

Fixes: c780e86dd4 ("blktrace: Protect q->blk_trace with RCU")
Cc: stable@vger.kernel.org
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Bob Liu <bob.liu@oracle.com>
Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Cengiz Can <cengiz@kernel.wtf>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-03-12 13:00:10 +01:00
..
bpf bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill 2020-02-28 17:22:27 +01:00
cgroup cgroup: Prevent double killing of css when enabling threaded cgroup 2020-02-05 21:22:42 +00:00
configs
debug
dma dma-direct: don't check swiotlb=force in dma_direct_map_resource 2020-01-26 10:01:08 +01:00
events perf/core: Fix mlock accounting in perf_mmap() 2020-02-11 04:35:54 -08:00
gcov Revert "um: Enable CONFIG_CONSTRUCTORS" 2020-02-01 09:34:53 +00:00
irq genirq/proc: Reject invalid affinity masks (again) 2020-02-28 17:22:26 +01:00
livepatch
locking locking/lockdep: Fix lockdep_stats indentation problem 2020-03-05 16:43:51 +01:00
power ACPI: PM: s2idle: Avoid possible race related to the EC GPE 2020-02-19 19:52:56 +01:00
printk printk: fix exclusive_console replaying 2020-02-24 08:36:24 +01:00
rcu rcu: Allow only one expedited GP to run concurrently with wakeups 2020-03-05 16:43:50 +01:00
sched sched/fair: Optimize select_idle_cpu 2020-03-05 16:43:48 +01:00
time lib/vdso: Update coarse timekeeper unconditionally 2020-03-05 16:43:49 +01:00
trace blktrace: fix dereference after null check 2020-03-12 13:00:10 +01:00
.gitignore
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
Makefile
acct.c
async.c
audit.c audit: always check the netlink payload length in audit_receive_msg() 2020-03-05 16:43:42 +01:00
audit.h
audit_fsnotify.c
audit_tree.c
audit_watch.c
auditfilter.c audit: fix error handling in audit_data_to_entry() 2020-03-05 16:43:42 +01:00
auditsc.c
backtracetest.c
bounds.c
capability.c
compat.c
configs.c
context_tracking.c
cpu.c cpu/hotplug, stop_machine: Fix stop_machine vs hotplug order 2020-02-24 08:36:23 +01:00
cpu_pm.c
crash_core.c
crash_dump.c
cred.c keys: Fix request_key() cache 2020-01-17 19:48:42 +01:00
delayacct.c
dma.c
elfcore.c
exec_domain.c
exit.c exit: panic before exit_mm() on global init exit 2020-01-09 10:20:01 +01:00
extable.c
fail_function.c
fork.c clone3: ensure copy_thread_tls is implemented 2020-01-14 20:08:35 +01:00
freezer.c
futex.c
gen_kheaders.sh
groups.c
hung_task.c
iomem.c
irq_work.c
jump_label.c
kallsyms.c
kcmp.c
kcov.c
kexec.c
kexec_core.c
kexec_elf.c
kexec_file.c
kexec_internal.h
kheaders.c
kmod.c
kprobes.c kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic 2020-03-12 13:00:09 +01:00
ksysfs.c
kthread.c
latencytop.c
module-internal.h
module.c module: avoid setting info->name early in case we can fall back to info->mod->name 2020-02-24 08:36:54 +01:00
module_signature.c
module_signing.c
notifier.c
nsproxy.c
padata.c padata: validate cpumask without removed CPU during offline 2020-02-24 08:36:34 +01:00
panic.c
params.c
pid.c
pid_namespace.c
profile.c
ptrace.c ptrace: reintroduce usage of subjective credentials in ptrace_has_cap() 2020-01-23 08:22:36 +01:00
range.c
reboot.c
relay.c
resource.c
rseq.c
seccomp.c seccomp: Check that seccomp_notif is zeroed out by the user 2020-01-09 10:19:57 +01:00
signal.c
smp.c
smpboot.c
smpboot.h
softirq.c
stackleak.c
stacktrace.c
stop_machine.c
sys.c
sys_ni.c
sysctl.c
sysctl_binary.c
task_work.c
taskstats.c
test_kprobes.c
torture.c
tracepoint.c
tsacct.c
ucount.c
uid16.c
uid16.h
umh.c
up.c
user-return-notifier.c
user.c
user_namespace.c
utsname.c
utsname_sysctl.c
watchdog.c watchdog/softlockup: Enforce that timestamp is valid on boot 2020-02-24 08:36:52 +01:00
watchdog_hld.c
workqueue.c workqueue: Add RCU annotation for pwq list walk 2020-01-26 10:01:07 +01:00
workqueue_internal.h