| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 27 Jan 2016 18:17:04 +0100
From: Dmitry Vyukov <dvyukov@...gle.com>
To: Jiri Kosina <jikos@...nel.org>
Cc: NeilBrown <neilb@...e.com>, Takashi Iwai <tiwai@...e.de>,
Jens Axboe <axboe@...com>, Hannes Reinecke <hare@...e.de>,
Rasmus Villemoes <linux@...musvillemoes.dk>,
LKML <linux-kernel@...r.kernel.org>,
syzkaller <syzkaller@...glegroups.com>,
Kostya Serebryany <kcc@...gle.com>,
Alexander Potapenko <glider@...gle.com>,
Sasha Levin <sasha.levin@...cle.com>
Subject: Re: floppy: GPF in floppy_rb0_cb
On Wed, Jan 27, 2016 at 5:55 PM, Jiri Kosina <jikos@...nel.org> wrote:
> On Mon, 25 Jan 2016, Dmitry Vyukov wrote:
>
>> Here is a complete log:
>> https://gist.githubusercontent.com/dvyukov/bd7923ece774521d6136/raw/5fae6326d90360d8bd49d6e06e0b3a7f132f00ac/gistfile1.txt
>> It is intermixed with executed programs, but you can grep for "] floppy".
>> There seems to be a bunch of "floppy: error -5 while reading block 0" errors.
>
> Alright, there is a serious issue with how floppy_revalidate() handles
> error from lock_fdc() (in-depth explanation for the curious: it doesn't).
>
> In case wait_for_event_interruptible() is actually interrupted without
> succesfully claiming fdc, we proceed with revalidation, causing all kinds
> of havoc (because another parallel request is still in progress).
>
> The whole story with the 'interruptible' parameter to lock_fdc() is funny
> as well, because we always wait interruptibly anyway. So it can be nuked.
> Most of the lock_fdc() callsites do properly handle error (and propagate
> EINTR), but floppy_revalidate() and floppy_check_events() don't.
>
> Could you please let syzkaller retest with the patch below? It fixes all
> the oopses I am able to trigger here.
Done. I will get back to you if I see any other oops.
> Thanks.
>
>
> diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
> index 9e25120..b206115 100644
> --- a/drivers/block/floppy.c
> +++ b/drivers/block/floppy.c
> @@ -866,7 +866,7 @@ static void set_fdc(int drive)
> }
>
> /* locks the driver */
> -static int lock_fdc(int drive, bool interruptible)
> +static int lock_fdc(int drive)
> {
> if (WARN(atomic_read(&usage_count) == 0,
> "Trying to lock fdc while usage count=0\n"))
> @@ -2173,7 +2173,7 @@ static int do_format(int drive, struct format_descr *tmp_format_req)
> {
> int ret;
>
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
>
> set_floppy(drive);
> @@ -2960,7 +2960,7 @@ static int user_reset_fdc(int drive, int arg, bool interruptible)
> {
> int ret;
>
> - if (lock_fdc(drive, interruptible))
> + if (lock_fdc(drive))
> return -EINTR;
>
> if (arg == FD_RESET_ALWAYS)
> @@ -3243,7 +3243,7 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
> if (!capable(CAP_SYS_ADMIN))
> return -EPERM;
> mutex_lock(&open_lock);
> - if (lock_fdc(drive, true)) {
> + if (lock_fdc(drive)) {
> mutex_unlock(&open_lock);
> return -EINTR;
> }
> @@ -3263,7 +3263,7 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
> } else {
> int oldStretch;
>
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> if (cmd != FDDEFPRM) {
> /* notice a disk change immediately, else
> @@ -3349,7 +3349,7 @@ static int get_floppy_geometry(int drive, int type, struct floppy_struct **g)
> if (type)
> *g = &floppy_type[type];
> else {
> - if (lock_fdc(drive, false))
> + if (lock_fdc(drive))
> return -EINTR;
> if (poll_drive(false, 0) == -EINTR)
> return -EINTR;
> @@ -3433,7 +3433,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> if (UDRS->fd_ref != 1)
> /* somebody else has this drive open */
> return -EBUSY;
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
>
> /* do the actual eject. Fails on
> @@ -3445,7 +3445,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> process_fd_request();
> return ret;
> case FDCLRPRM:
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> current_type[drive] = NULL;
> floppy_sizes[drive] = MAX_DISK_SIZE << 1;
> @@ -3467,7 +3467,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> UDP->flags &= ~FTD_MSG;
> return 0;
> case FDFMTBEG:
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR)
> return -EINTR;
> @@ -3484,7 +3484,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> return do_format(drive, &inparam.f);
> case FDFMTEND:
> case FDFLUSH:
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> return invalidate_drive(bdev);
> case FDSETEMSGTRESH:
> @@ -3507,7 +3507,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> outparam = UDP;
> break;
> case FDPOLLDRVSTAT:
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR)
> return -EINTR;
> @@ -3530,7 +3530,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> case FDRAWCMD:
> if (type)
> return -EINVAL;
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> set_floppy(drive);
> i = raw_cmd_ioctl(cmd, (void __user *)param);
> @@ -3539,7 +3539,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> process_fd_request();
> return i;
> case FDTWADDLE:
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> twaddle();
> process_fd_request();
> @@ -3748,7 +3748,8 @@ static unsigned int floppy_check_events(struct gendisk *disk,
> return DISK_EVENT_MEDIA_CHANGE;
>
> if (time_after(jiffies, UDRS->last_checked + UDP->checkfreq)) {
> - lock_fdc(drive, false);
> + if (lock_fdc(drive))
> + return -EINTR;
> poll_drive(false, 0);
> process_fd_request();
> }
> @@ -3847,7 +3848,9 @@ static int floppy_revalidate(struct gendisk *disk)
> "VFS: revalidate called on non-open device.\n"))
> return -EFAULT;
>
> - lock_fdc(drive, false);
> + res = lock_fdc(drive);
> + if (res)
> + return res;
> cf = (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags) ||
> test_bit(FD_VERIFY_BIT, &UDRS->flags));
> if (!(cf || test_bit(drive, &fake_change) || drive_no_geom(drive))) {
Powered by blists - more mailing lists