linux-kernel - Re: [PATCH] nbd: fix race in ioctl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 29 Jul 2016 12:55:01 +0200
From:	Vegard Nossum <vegard.nossum@...cle.com>
To:	Markus Pargmann <mpa@...gutronix.de>
Cc:	Jens Axboe <axboe@...com>,
	Quentin Casasnovas <quentin.casasnovas@...cle.com>,
	linux-block@...r.kernel.org, linux-kernel@...r.kernel.org,
	Paul Clements <paul.clements@...eleye.com>,
	Pavel Machek <pavel@...e.cz>, Al Viro <viro@...iv.linux.org.uk>
Subject: Re: [PATCH] nbd: fix race in ioctl

On 05/30/2016 02:58 PM, Markus Pargmann wrote:
> Hi,
>
> On Friday 27 May 2016 12:59:35 Vegard Nossum wrote:
>> Quentin ran into this bug:
>>
>> WARNING: CPU: 64 PID: 10085 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x65/0x80

[...]

>> It seems fairly obvious that device_create_file() is not being protected
>> from being run concurrently on the same nbd.
>>
>> Quentin found the following relevant commits:
>>
>> 1a2ad21 nbd: add locking to nbd_ioctl
>> 90b8f28 [PATCH] end of methods switch: remove the old ones
>> d4430d6 [PATCH] beginning of methods conversion
>> 08f8585 [PATCH] move block_device_operations to blkdev.h
>>
>> It would seem that the race was introduced in the process of moving nbd
>> from BKL to unlocked ioctls.
>>
>> By setting nbd->task_recv while the mutex is held, we can prevent other
>> processes from running concurrently (since nbd->task_recv is also checked
>> while the mutex is held).
>>
>> Reported-and-tested-by: Quentin Casasnovas <quentin.casasnovas@...cle.com>
>> Cc: Markus Pargmann <mpa@...gutronix.de>
>> Cc: Paul Clements <paul.clements@...eleye.com>
>> Cc: Pavel Machek <pavel@...e.cz>
>> Cc: Jens Axboe <axboe@...com>
>> Cc: Al Viro <viro@...iv.linux.org.uk>
>> Signed-off-by: Vegard Nossum <vegard.nossum@...cle.com>
>
> Thanks, applied.
>
> Best Regards,
>
> Markus

Hi,

I didn't see this patch in the batch that went into 4.8, so I'm just
following up to make sure it doesn't get lost.

Moreover, it should also probably go into stable.


Vegard