linux-kernel - [PATCH] bcache: Fix a NULL pointer dereference in detached_dev_do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20211130085139.74175-1-zhou1615@umn.edu>
Date:   Tue, 30 Nov 2021 16:51:39 +0800
From:   Zhou Qingyang <zhou1615@....edu>
To:     zhou1615@....edu
Cc:     kjlu@....edu, Coly Li <colyli@...e.de>,
        Kent Overstreet <kent.overstreet@...il.com>,
        Hannes Reinecke <hare@...e.com>, Michael Lyle <mlyle@...e.org>,
        Tang Junhui <tang.junhui@....com.cn>,
        Jens Axboe <axboe@...nel.dk>, linux-bcache@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH] bcache: Fix a NULL pointer dereference in detached_dev_do_request()

In detached_dev_do_request(), the return value of kzalloc() is
assigned to ddip, and there is a dereference of it in
detached_dev_do_request(), which could lead to a NULL pointer
dereference on failure of kzalloc().

Fix this bug by adding a check of ddip. This patch imitates the
failure-handling logic in cached_dev_submit_bio().

Note that we found the fixing of the bug hard, as the return value of
the callers is void and we cannot pass an error status upstream.
Please adivce if there is a better way for fixing.

This bug was found by a static analyzer. The analysis employs
differential checking to identify inconsistent security operations
(e.g., checks or kfrees) between two code paths and confirms that the
inconsistent operations are not recovered in the current function or
the callers, so they constitute bugs.

Note that, as a bug found by static analysis, it might be a false
positive or hard to trigger. Multiple researchers have cross-reviewed
the bug.

Builds with CONFIG_BCACHE=m show no new warnings, and our static
analyzer no longer warns about this code.

Fixes:  bc082a55d25c ("bcache: fix inaccurate io state for detached bcache devices")
Signed-off-by: Zhou Qingyang <zhou1615@....edu>
---
 drivers/md/bcache/request.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index d15aae6c51c1..3a17925c734b 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -1107,6 +1107,11 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
 	 * which would call closure_get(&dc->disk.cl)
 	 */
 	ddip = kzalloc(sizeof(struct detached_dev_io_private), GFP_NOIO);
+	if (!ddip) {
+		bio->bi_status = BLK_STS_RESOURCE;
+		bio_endio(bio);
+		return;
+	}
 	ddip->d = d;
 	/* Count on the bcache device */
 	ddip->orig_bdev = orig_bdev;
-- 
2.25.1