diff options
| author | Yu Kuai <yukuai3@huawei.com> | 2025-01-03 17:28:59 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-02-08 09:56:51 +0100 |
| commit | a8ee6ecde2b7bfb58c8a3afe8a9d2b848f580739 (patch) | |
| tree | 9b8e7a2663c8bdbae92eaaa55f5c74b1c8aa075d /drivers/block | |
| parent | 20e84b406feadab5c0e5d700c0cdf738a229778c (diff) | |
| download | linux-a8ee6ecde2b7bfb58c8a3afe8a9d2b848f580739.tar.gz linux-a8ee6ecde2b7bfb58c8a3afe8a9d2b848f580739.tar.bz2 linux-a8ee6ecde2b7bfb58c8a3afe8a9d2b848f580739.zip | |
nbd: don't allow reconnect after disconnect
[ Upstream commit 844b8cdc681612ff24df62cdefddeab5772fadf1 ]
Following process can cause nbd_config UAF:
1) grab nbd_config temporarily;
2) nbd_genl_disconnect() flush all recv_work() and release the
initial reference:
nbd_genl_disconnect
nbd_disconnect_and_put
nbd_disconnect
flush_workqueue(nbd->recv_workq)
if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...))
nbd_config_put
-> due to step 1), reference is still not zero
3) nbd_genl_reconfigure() queue recv_work() again;
nbd_genl_reconfigure
config = nbd_get_config_unlocked(nbd)
if (!config)
-> succeed
if (!test_bit(NBD_RT_BOUND, ...))
-> succeed
nbd_reconnect_socket
queue_work(nbd->recv_workq, &args->work)
4) step 1) release the reference;
5) Finially, recv_work() will trigger UAF:
recv_work
nbd_config_put(nbd)
-> nbd_config is freed
atomic_dec(&config->recv_threads)
-> UAF
Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so
that nbd_genl_reconfigure() will fail.
Fixes: b7aa3d39385d ("nbd: add a reconfigure netlink command")
Reported-by: syzbot+6b0df248918b92c33e6a@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/675bfb65.050a0220.1a2d0d.0006.GAE@google.com/
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20250103092859.3574648-1-yukuai1@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/block')
| -rw-r--r-- | drivers/block/nbd.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index b852050d8a96..450458267e6e 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -2180,6 +2180,7 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd) flush_workqueue(nbd->recv_workq); nbd_clear_que(nbd); nbd->task_setup = NULL; + clear_bit(NBD_RT_BOUND, &nbd->config->runtime_flags); mutex_unlock(&nbd->config_lock); if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, |