lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 7 Jun 2022 14:02:19 -0400 From: Sasha Levin <sashal@...nel.org> To: linux-kernel@...r.kernel.org, stable@...r.kernel.org Cc: Guoqing Jiang <guoqing.jiang@...ud.ionos.com>, Donald Buczek <buczek@...gen.mpg.de>, Guoqing Jiang <guoqing.jiang@...ux.dev>, Song Liu <song@...nel.org>, Sasha Levin <sashal@...nel.org>, linux-raid@...r.kernel.org Subject: [PATCH AUTOSEL 4.14 18/25] md: protect md_unregister_thread from reentrancy From: Guoqing Jiang <guoqing.jiang@...ud.ionos.com> [ Upstream commit 1e267742283a4b5a8ca65755c44166be27e9aa0f ] Generally, the md_unregister_thread is called with reconfig_mutex, but raid_message in dm-raid doesn't hold reconfig_mutex to unregister thread, so md_unregister_thread can be called simulitaneously from two call sites in theory. Then after previous commit which remove the protection of reconfig_mutex for md_unregister_thread completely, the potential issue could be worse than before. Let's take pers_lock at the beginning of function to ensure reentrancy. Reported-by: Donald Buczek <buczek@...gen.mpg.de> Signed-off-by: Guoqing Jiang <guoqing.jiang@...ux.dev> Signed-off-by: Song Liu <song@...nel.org> Signed-off-by: Sasha Levin <sashal@...nel.org> --- drivers/md/md.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 85bccc53fdd1..bdbd62007ee5 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -7588,17 +7588,22 @@ EXPORT_SYMBOL(md_register_thread); void md_unregister_thread(struct md_thread **threadp) { - struct md_thread *thread = *threadp; - if (!thread) - return; - pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk)); - /* Locking ensures that mddev_unlock does not wake_up a + struct md_thread *thread; + + /* + * Locking ensures that mddev_unlock does not wake_up a * non-existent thread */ spin_lock(&pers_lock); + thread = *threadp; + if (!thread) { + spin_unlock(&pers_lock); + return; + } *threadp = NULL; spin_unlock(&pers_lock); + pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk)); kthread_stop(thread->tsk); kfree(thread); } -- 2.35.1
Powered by blists - more mailing lists