linux-kernel - Re: [PATCH] blktrace: fix dereference after null check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 3 Mar 2020 09:14:36 -0500
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Cengiz Can <cengiz@...nel.wtf>
Cc:     Jens Axboe <axboe@...nel.dk>, Ingo Molnar <mingo@...hat.com>,
        linux-block@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] blktrace: fix dereference after null check

On Tue,  3 Mar 2020 10:33:59 +0300
Cengiz Can <cengiz@...nel.wtf> wrote:

> There was a recent change in blktrace.c that added a RCU protection to
> `q->blk_trace` in order to fix a use-after-free issue during access.
> 
> However the change missed an edge case that can lead to dereferencing of
> `bt` pointer even when it's NULL:
> 
> ```
>         bt->act_mask = value; // bt can still be NULL here
> ```
> 
> Added a reassignment into the NULL check block to fix the issue.

Note, you should probably add a note in your change log that this issue was
found by Coverity. Sometimes static analyzers have a tag of some kind that
they would like patches that fix the issues they discover to be in the
change log. This way they can track the fixes that are found by the tool.

> 
> Fixes: c780e86dd48 ("blktrace: Protect q->blk_trace with RCU")
> 
> Signed-off-by: Cengiz Can <cengiz@...nel.wtf>
> ---
>  Huge thanks goes to Steven Rostedt for his assistance.
> 
>  kernel/trace/blktrace.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
> index 4560878f0bac..29ea88f10b87 100644
> --- a/kernel/trace/blktrace.c
> +++ b/kernel/trace/blktrace.c
> @@ -1896,8 +1896,10 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
>  	}
> 
>  	ret = 0;
> -	if (bt == NULL)
> +	if (bt == NULL) {
>  		ret = blk_trace_setup_queue(q, bdev);
> +		bt = q->blk_trace;

As I said in the other email, the above assignment still needs RCU
annotation:

		bt = rcu_dereference_protected(q->blk_trace,
				lockdep_is_held(&q->blk_trace_mutex));

Otherwise, other static analyzers will flag this as a problem.

-- Steve


> +	}
> 
>  	if (ret == 0) {
>  		if (attr == &dev_attr_act_mask)
> --
> 2.25.1