OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/drivers/md
History
Ye Bin 291144f111 dm thin metadata: Fix use-after-free in dm_bm_set_read_only 
commit 3a653b205f upstream.

The following error ocurred when testing disk online/offline:

[  301.798344] device-mapper: thin: 253:5: aborting current metadata transaction
[  301.848441] device-mapper: thin: 253:5: failed to abort metadata transaction
[  301.849206] Aborting journal on device dm-26-8.
[  301.850489] EXT4-fs error (device dm-26) in __ext4_new_inode:943: Journal has aborted
[  301.851095] EXT4-fs (dm-26): Delayed block allocation failed for inode 398742 at logical offset 181 with max blocks 19 with error 30
[  301.854476] BUG: KASAN: use-after-free in dm_bm_set_read_only+0x3a/0x40 [dm_persistent_data]

Reason is:

 metadata_operation_failed
    abort_transaction
        dm_pool_abort_metadata
	    __create_persistent_data_objects
	        r = __open_or_format_metadata
	        if (r) --> If failed will free pmd->bm but pmd->bm not set NULL
		    dm_block_manager_destroy(pmd->bm);
    set_pool_mode
	dm_pool_metadata_read_only(pool->pmd);
	dm_bm_set_read_only(pmd->bm);  --> use-after-free

Add checks to see if pmd->bm is NULL in dm_bm_set_read_only and
dm_bm_set_read_write functions.  If bm is NULL it means creating the
bm failed and so dm_bm_is_read_only must return true.

Signed-off-by: Ye Bin <yebin10@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2020-09-09 19:12:36 +02:00
..
bcache bcache: avoid nr_stripes overflow in bcache_device_init() 2020-08-26 10:40:48 +02:00
persistent-data dm thin metadata: Fix use-after-free in dm_bm_set_read_only 2020-09-09 19:12:36 +02:00
Kconfig dm: add clone target 2019-09-12 09:32:31 -04:00
Makefile dm: add clone target 2019-09-12 09:32:31 -04:00
dm-bio-prison-v1.c
…
dm-bio-prison-v1.h
…
dm-bio-prison-v2.c
…
dm-bio-prison-v2.h
…
dm-bio-record.h dm bio record: save/restore bi_end_io and bi_integrity 2020-03-25 08:25:48 +01:00
dm-bufio.c dm bufio: introduce a global cache replacement 2019-09-13 17:00:21 -04:00
dm-builtin.c
…
dm-cache-background-tracker.c
…
dm-cache-background-tracker.h
…
dm-cache-block-types.h
…
dm-cache-metadata.c dm cache metadata: Avoid returning cmd->bm wild pointer on error 2020-09-09 19:12:35 +02:00
dm-cache-metadata.h
…
dm-cache-policy-internal.h
…
dm-cache-policy-smq.c
…
dm-cache-policy.c
…
dm-cache-policy.h
…
dm-cache-target.c dm cache: fix a crash due to incorrect work item cancelling 2020-03-12 13:00:23 +01:00
dm-clone-metadata.c dm clone: Fix handling of partial region discards 2020-04-17 10:50:24 +02:00
dm-clone-metadata.h dm clone: replace spin_lock_irqsave with spin_lock_irq 2020-04-17 10:50:23 +02:00
dm-clone-target.c dm clone: Add missing casts to prevent overflows and data corruption 2020-04-17 10:50:24 +02:00
dm-core.h dm: disable DISCARD if the underlying storage no longer supports it 2019-04-04 15:33:59 -04:00
dm-crypt.c dm crypt: Initialize crypto wait structures 2020-09-09 19:12:35 +02:00
dm-delay.c dm delay: fix a crash when invalid device is specified 2019-04-26 11:29:32 -04:00
dm-dust.c dm dust: use dust block size for badblocklist index 2019-08-21 11:27:17 -04:00
dm-era-target.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
dm-exception-store.c
…
dm-exception-store.h - Improve DM snapshot target's scalability by using finer grained 2019-05-16 15:55:48 -07:00
dm-flakey.c block: Kill gfp_t argument of blkdev_report_zones() 2019-07-11 20:04:37 -06:00
dm-init.c docs: device-mapper: move it to the admin-guide 2019-07-15 11:03:01 -03:00
dm-integrity.c dm integrity: fix error reporting in bitmap mode after creation 2020-09-09 19:12:35 +02:00
dm-io.c
…
dm-ioctl.c dm: introduce DM_GET_TARGET_VERSION 2019-09-16 10:18:01 -04:00
dm-kcopyd.c dm kcopyd: always complete failed jobs 2019-08-15 15:57:39 -04:00
dm-linear.c block: Kill gfp_t argument of blkdev_report_zones() 2019-07-11 20:04:37 -06:00
dm-log-userspace-base.c
…
dm-log-userspace-transfer.c
…
dm-log-userspace-transfer.h
…
dm-log-writes.c dm log writes: fix incorrect comment about the logged sequence example 2019-07-09 14:13:33 -04:00
dm-log.c
…
dm-mpath.c dm mpath: fix racey management of PG initialization 2020-09-09 19:12:35 +02:00
dm-mpath.h
…
dm-path-selector.c
…
dm-path-selector.h
…
dm-queue-length.c
…
dm-raid.c dm raid: fix updating of max_discard_sectors limit 2019-09-11 16:18:23 -04:00
dm-raid1.c dm raid1: use struct_size() with kzalloc() 2019-08-26 11:05:32 -04:00
dm-region-hash.c
…
dm-round-robin.c
…
dm-rq.c dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue() 2020-08-21 13:05:33 +02:00
dm-rq.h dm: remove unused _rq_tio_cache and _rq_cache 2019-03-05 14:48:50 -05:00
dm-service-time.c
…
dm-snap-persistent.c block: fix an integer overflow in logical block size 2020-01-23 08:22:32 +01:00
dm-snap-transient.c
…
dm-snap.c dm snapshot: rework COW throttling to fix deadlock 2019-10-10 09:46:05 -04:00
dm-stats.c dm stats: use struct_size() helper 2019-09-04 09:39:22 -04:00
dm-stats.h
…
dm-stripe.c
…
dm-switch.c dm switch: use struct_size() in kzalloc() 2019-03-05 14:48:51 -05:00
dm-sysfs.c
…
dm-table.c dm: make dm_table_find_target return NULL 2019-08-23 10:13:12 -04:00
dm-target.c dm mpath: fix missing call of path selector type->end_io 2019-04-25 15:38:52 -04:00
dm-thin-metadata.c dm thin metadata: Fix use-after-free in dm_bm_set_read_only 2020-09-09 19:12:36 +02:00
dm-thin-metadata.h dm thin metadata: Add support for a pre-commit callback 2019-12-21 11:05:01 +01:00
dm-thin.c dm thin: don't allow changing data device during thin-pool reload 2020-02-24 08:36:49 +01:00
dm-uevent.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
dm-uevent.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
dm-unstripe.c
…
dm-verity-fec.c dm verity fec: fix hash block number in verity_fec_decode 2020-05-06 08:15:10 +02:00
dm-verity-fec.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
dm-verity-target.c dm verity: add root hash pkcs#7 signature verification 2019-08-23 10:13:14 -04:00
dm-verity-verify-sig.c dm verity: add root hash pkcs#7 signature verification 2019-08-23 10:13:14 -04:00
dm-verity-verify-sig.h dm verity: add root hash pkcs#7 signature verification 2019-08-23 10:13:14 -04:00
dm-verity.h dm verity: add root hash pkcs#7 signature verification 2019-08-23 10:13:14 -04:00
dm-writecache.c dm writecache: handle DAX to partitions on persistent memory correctly 2020-09-09 19:12:35 +02:00
dm-zero.c
…
dm-zoned-metadata.c dm zoned: return NULL if dmz_get_zone_for_reclaim() fails to find a zone 2020-06-24 17:50:31 +02:00
dm-zoned-reclaim.c dm zoned: return NULL if dmz_get_zone_for_reclaim() fails to find a zone 2020-06-24 17:50:31 +02:00
dm-zoned-target.c dm zoned: assign max_io_len correctly 2020-07-09 09:37:57 +02:00
dm-zoned.h dm zoned: reduce overhead of backing device checks 2019-12-17 19:56:12 +01:00
dm.c dm integrity: fix integrity recalculation that is improperly skipped 2020-07-29 10:18:45 +02:00
dm.h dm: make dm_table_find_target return NULL 2019-08-23 10:13:12 -04:00
md-bitmap.c md/bitmap: avoid race window between md_bitmap_resize and bitmap_file_clear_bit 2019-12-31 16:44:20 +01:00
md-bitmap.h
…
md-cluster.c md-cluster: Fix potential error pointer dereference in resize_bitmaps() 2020-08-21 13:05:36 +02:00
md-cluster.h
…
md-faulty.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 47 2019-05-24 17:27:13 +02:00
md-linear.c md: improve handling of bio with REQ_PREFLUSH in md_flush_request() 2019-12-17 19:56:14 +01:00
md-linear.h
…
md-multipath.c md: improve handling of bio with REQ_PREFLUSH in md_flush_request() 2019-12-17 19:56:14 +01:00
md-multipath.h
…
md.c md: raid0/linear: fix dereference before null check on pointer mddev 2020-08-19 08:15:58 +02:00
md.h md: improve handling of bio with REQ_PREFLUSH in md_flush_request() 2019-12-17 19:56:14 +01:00
raid0.c block: fix an integer overflow in logical block size 2020-01-23 08:22:32 +01:00
raid0.h md/raid0: avoid RAID0 data corruption due to layout confusion. 2019-09-13 13:10:05 -07:00
raid1-10.c md: raid1-10: Unify r{1,10}bio_pool_free 2019-06-15 01:37:35 -06:00
raid1.c md: raid1: check rdev before reference in raid1_sync_request func 2020-01-09 10:19:48 +01:00
raid1.h
…
raid5-cache.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288 2019-06-05 17:36:37 +02:00
raid5-log.h raid5: set write hint for PPL 2019-03-12 10:15:18 -07:00
raid5-ppl.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288 2019-06-05 17:36:37 +02:00
raid5.c md/raid5: Fix Force reconstruct-write io stuck in degraded raid5 2020-08-21 13:05:25 +02:00
raid5.h raid5: use bio_end_sector in r5_next_bio 2019-09-13 13:14:43 -07:00
raid10.c md: improve handling of bio with REQ_PREFLUSH in md_flush_request() 2019-12-17 19:56:14 +01:00
raid10.h
…