mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/drivers/md
History
Ye Bin 3a653b205f dm thin metadata: Fix use-after-free in dm_bm_set_read_only 
The following error ocurred when testing disk online/offline:

[  301.798344] device-mapper: thin: 253:5: aborting current metadata transaction
[  301.848441] device-mapper: thin: 253:5: failed to abort metadata transaction
[  301.849206] Aborting journal on device dm-26-8.
[  301.850489] EXT4-fs error (device dm-26) in __ext4_new_inode:943: Journal has aborted
[  301.851095] EXT4-fs (dm-26): Delayed block allocation failed for inode 398742 at logical offset 181 with max blocks 19 with error 30
[  301.854476] BUG: KASAN: use-after-free in dm_bm_set_read_only+0x3a/0x40 [dm_persistent_data]

Reason is:

 metadata_operation_failed
    abort_transaction
        dm_pool_abort_metadata
	    __create_persistent_data_objects
	        r = __open_or_format_metadata
	        if (r) --> If failed will free pmd->bm but pmd->bm not set NULL
		    dm_block_manager_destroy(pmd->bm);
    set_pool_mode
	dm_pool_metadata_read_only(pool->pmd);
	dm_bm_set_read_only(pmd->bm);  --> use-after-free

Add checks to see if pmd->bm is NULL in dm_bm_set_read_only and
dm_bm_set_read_write functions.  If bm is NULL it means creating the
bm failed and so dm_bm_is_read_only must return true.

Signed-off-by: Ye Bin <yebin10@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
 		2020-09-02 13:38:40 -04:00
..
bcache treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
persistent-data dm thin metadata: Fix use-after-free in dm_bm_set_read_only 2020-09-02 13:38:40 -04:00
Kconfig Replace HTTP links with HTTPS ones: LVM 2020-07-05 14:28:27 -06:00
Makefile md: move the early init autodetect code to drivers/md/ 2020-07-16 15:34:47 +02:00
dm-bio-prison-v1.c dm bio prison: replace spin_lock_irqsave with spin_lock_irq 2019-11-05 14:53:03 -05:00
dm-bio-prison-v1.h
…
dm-bio-prison-v2.c dm bio prison v2: use true/false for bool variable 2020-01-07 12:07:08 -05:00
dm-bio-prison-v2.h
…
dm-bio-record.h dm bio record: save/restore bi_end_io and bi_integrity 2020-03-03 10:02:46 -05:00
dm-bufio.c dm bufio: do buffer cleanup from a workqueue 2020-07-20 11:17:43 -04:00
dm-builtin.c
…
dm-cache-background-tracker.c
…
dm-cache-background-tracker.h
…
dm-cache-block-types.h
…
dm-cache-metadata.c dm cache metadata: Avoid returning cmd->bm wild pointer on error 2020-09-02 13:38:24 -04:00
dm-cache-metadata.h
…
dm-cache-policy-internal.h
…
dm-cache-policy-smq.c
…
dm-cache-policy.c
…
dm-cache-policy.h
…
dm-cache-target.c writeback: remove bdi->congested_fn 2020-07-08 17:20:46 -06:00
dm-clone-metadata.c dm clone metadata: Fix return type of dm_clone_nr_of_hydrated_regions() 2020-03-27 14:42:51 -04:00
dm-clone-metadata.h dm clone metadata: Fix return type of dm_clone_nr_of_hydrated_regions() 2020-03-27 14:42:51 -04:00
dm-clone-target.c writeback: remove bdi->congested_fn 2020-07-08 17:20:46 -06:00
dm-core.h
…
dm-crypt.c dm crypt: Initialize crypto wait structures 2020-09-01 16:41:57 -04:00
dm-delay.c block: rename generic_make_request to submit_bio_noacct 2020-07-01 07:27:24 -06:00
dm-dust.c dm dust: add interface to list all badblocks 2020-07-20 11:17:41 -04:00
dm-ebs-target.c dm ebs: Fix incorrect checking for REQ_OP_FLUSH 2020-08-04 16:01:40 -04:00
dm-era-target.c writeback: remove bdi->congested_fn 2020-07-08 17:20:46 -06:00
dm-exception-store.c
…
dm-exception-store.h - Improve DM snapshot target's scalability by using finer grained 2019-05-16 15:55:48 -07:00
dm-flakey.c block: rework zone reporting 2019-11-12 19:12:07 -07:00
dm-historical-service-time.c dm mpath: add Historical Service Time Path Selector 2020-05-15 10:29:36 -04:00
dm-init.c dm init: Set file local variable static 2020-08-04 15:51:28 -04:00
dm-integrity.c dm integrity: fix error reporting in bitmap mode after creation 2020-09-01 16:41:57 -04:00
dm-io.c treewide: Remove uninitialized_var() usage 2020-07-16 12:35:15 -07:00
dm-ioctl.c - DM multipath locking fixes around m->flags tests and improvements to 2020-08-07 13:08:09 -07:00
dm-kcopyd.c dm kcopyd: always complete failed jobs 2019-08-15 15:57:39 -04:00
dm-linear.c dm,dax: Add dax zero_page_range operation 2020-04-02 19:15:03 -07:00
dm-log-userspace-base.c
…
dm-log-userspace-transfer.c
…
dm-log-userspace-transfer.h
…
dm-log-writes.c dm: replace zero-length array with flexible-array 2020-05-20 17:09:44 -04:00
dm-log.c
…
dm-mpath.c dm mpath: fix racey management of PG initialization 2020-09-01 16:41:56 -04:00
dm-mpath.h
…
dm-path-selector.c
…
dm-path-selector.h dm mpath: pass IO start time to path selector 2020-05-15 10:29:36 -04:00
dm-queue-length.c dm mpath: pass IO start time to path selector 2020-05-15 10:29:36 -04:00
dm-raid.c - DM multipath locking fixes around m->flags tests and improvements to 2020-08-07 13:08:09 -07:00
dm-raid1.c block: rename generic_make_request to submit_bio_noacct 2020-07-01 07:27:24 -06:00
dm-region-hash.c
…
dm-round-robin.c
…
dm-rq.c - DM multipath locking fixes around m->flags tests and improvements to 2020-08-07 13:08:09 -07:00
dm-rq.h
…
dm-service-time.c dm mpath: pass IO start time to path selector 2020-05-15 10:29:36 -04:00
dm-snap-persistent.c Remove uninitialized_var() macro for v5.9-rc1 2020-08-04 13:49:43 -07:00
dm-snap-transient.c
…
dm-snap.c block: rename generic_make_request to submit_bio_noacct 2020-07-01 07:27:24 -06:00
dm-stats.c dm: replace zero-length array with flexible-array 2020-05-20 17:09:44 -04:00
dm-stats.h
…
dm-stripe.c dm: replace zero-length array with flexible-array 2020-05-20 17:09:44 -04:00
dm-switch.c dm: replace zero-length array with flexible-array 2020-05-20 17:09:44 -04:00
dm-sysfs.c
…
dm-table.c for-5.9/block-merge-20200804 2020-08-05 11:12:34 -07:00
dm-target.c
…
dm-thin-metadata.c dm thin metadata: Fix use-after-free in dm_bm_set_read_only 2020-09-02 13:38:40 -04:00
dm-thin-metadata.h dm thin metadata: Add support for a pre-commit callback 2019-12-05 17:05:24 -05:00
dm-thin.c writeback: remove bdi->congested_fn 2020-07-08 17:20:46 -06:00
dm-uevent.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
dm-uevent.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
dm-unstripe.c
…
dm-verity-fec.c dm verity fec: fix hash block number in verity_fec_decode 2020-04-16 16:16:38 -04:00
dm-verity-fec.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
dm-verity-target.c - DM multipath locking fixes around m->flags tests and improvements to 2020-08-07 13:08:09 -07:00
dm-verity-verify-sig.c dm verity: add root hash pkcs#7 signature verification 2019-08-23 10:13:14 -04:00
dm-verity-verify-sig.h dm verity: Fix compilation warning 2020-08-04 15:48:13 -04:00
dm-verity.h dm verity: add "panic_on_corruption" error handling mode 2020-07-13 11:47:33 -04:00
dm-writecache.c dm writecache: handle DAX to partitions on persistent memory correctly 2020-09-01 16:41:55 -04:00
dm-zero.c
…
dm-zoned-metadata.c dm zoned: Fix zone reclaim trigger 2020-07-08 12:21:53 -04:00
dm-zoned-reclaim.c dm zoned: Fix zone reclaim trigger 2020-07-08 12:21:53 -04:00
dm-zoned-target.c for-5.9/block-20200802 2020-08-03 11:57:03 -07:00
dm-zoned.h dm zoned: select reclaim zone based on device index 2020-06-05 14:59:53 -04:00
dm.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
dm.h writeback: remove bdi->congested_fn 2020-07-08 17:20:46 -06:00
md-autodetect.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
md-bitmap.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
md-bitmap.h
…
md-cluster.c md-cluster: Fix potential error pointer dereference in resize_bitmaps() 2020-08-05 17:07:48 -07:00
md-cluster.h
…
md-faulty.c block: rename generic_make_request to submit_bio_noacct 2020-07-01 07:27:24 -06:00
md-linear.c writeback: remove bdi->congested_fn 2020-07-08 17:20:46 -06:00
md-linear.h md/raid1: Replace zero-length array with flexible-array 2020-05-13 12:02:23 -07:00
md-multipath.c writeback: remove bdi->congested_fn 2020-07-08 17:20:46 -06:00
md-multipath.h
…
md.c block-5.9-2020-08-14 2020-08-15 20:36:42 -07:00
md.h Merge branch 'hch.init_path' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-08-07 09:40:34 -07:00
raid0.c writeback: remove bdi->congested_fn 2020-07-08 17:20:46 -06:00
raid0.h md/raid0: avoid RAID0 data corruption due to layout confusion. 2019-09-13 13:10:05 -07:00
raid1-10.c md: raid1-10: Unify r{1,10}bio_pool_free 2019-06-15 01:37:35 -06:00
raid1.c writeback: remove bdi->congested_fn 2020-07-08 17:20:46 -06:00
raid1.h md/raid1: Replace zero-length array with flexible-array 2020-05-13 12:02:23 -07:00
raid5-cache.c raid5-cache: hold spinlock instead of mutex in r5c_journal_mode_show 2020-08-02 23:03:52 -07:00
raid5-log.h
…
raid5-ppl.c md/raid456: convert macro STRIPE_* to RAID5_STRIPE_* 2020-07-21 17:18:12 -07:00
raid5.c block-5.9-2020-08-28 2020-08-28 16:38:29 -07:00
raid5.h A set of locking fixes and updates: 2020-08-10 19:07:44 -07:00
raid10.c for-5.9/drivers-20200803 2020-08-05 10:51:40 -07:00
raid10.h md/raid1: Replace zero-length array with flexible-array 2020-05-13 12:02:23 -07:00