linux-kernel - [PATCH] bcache: Fix bdev leak during backing device registering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20171123004238.79132-1-liangyan.ply@alibaba-inc.com>
Date:   Thu, 23 Nov 2017 08:42:38 +0800
From:   "彭良彦" <liangyan.ply@...baba-inc.com>
To:     "彭良彦" <liangyan.ply@...baba-inc.com>,
        "Kent Overstreet" <kent.overstreet@...il.com>,
        "Shaohua Li" <shli@...nel.org>,
        "Greg Kroah-Hartman" <gregkh@...uxfoundation.org>,
        <linux-bcache@...r.kernel.org>, <linux-raid@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, "Coly Li" <colyli@...e.de>,
        "秦承刚(承刚)" 
        <chenggang.qcg@...baba-inc.com>
Subject: [PATCH] bcache: Fix bdev leak during backing device registering

If the backing device hasn't been detached due to exceptional stop
like power outage, the BDEV_STATE in super block can't be reset,
it will fail to register this backing device in next time, but the
opened bdev will be hold, this makes the backing device unaccessable
because of FMODE_EXCL until reboot.

Signed-off-by: Liangyan Peng <liangyan.ply@...baba-inc.com>
---
 drivers/md/bcache/super.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 66669c8f4161..0b95a594c12e 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1174,9 +1174,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
 	list_for_each_entry(c, &bch_cache_sets, list)
 		bch_cached_dev_attach(dc, c);
 
-	if (BDEV_STATE(&dc->sb) == BDEV_STATE_NONE ||
-	    BDEV_STATE(&dc->sb) == BDEV_STATE_STALE)
-		bch_cached_dev_run(dc);
+	bch_cached_dev_run(dc);
 
 	return;
 err:
@@ -1982,7 +1980,16 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
 		goto err_close;
 
 	if (SB_IS_BDEV(sb)) {
-		struct cached_dev *dc = kzalloc(sizeof(*dc), GFP_KERNEL);
+		struct cached_dev *dc = NULL;
+
+		if (BDEV_STATE(sb) != BDEV_STATE_NONE &&
+			BDEV_STATE(sb) != BDEV_STATE_STALE) {
+			blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+			err = "invalid super block";
+			pr_info("Failed to register %s: %s", path, err);
+			goto out;
+		}
+		dc = kzalloc(sizeof(*dc), GFP_KERNEL);
 		if (!dc)
 			goto err_close;
 
-- 
2.14.1.40.g8e62ba1