linux/block
Benjamin Block eab40cf336 bsg-lib: fix use-after-free under memory-pressure
When under memory-pressure it is possible that the mempool which backs
the 'struct request_queue' will make use of up to BLKDEV_MIN_RQ count
emergency buffers - in case it can't get a regular allocation. These
buffers are preallocated and once they are also used, they are
re-supplied with old finished requests from the same request_queue (see
mempool_free()).

The bug is, when re-supplying the emergency pool, the old requests are
not again ran through the callback mempool_t->alloc(), and thus also not
through the callback bsg_init_rq(). Thus we skip initialization, and
while the sense-buffer still should be good, scsi_request->cmd might
have become to be an invalid pointer in the meantime. When the request
is initialized in bsg.c, and the user's CDB is larger than BLK_MAX_CDB,
bsg will replace it with a custom allocated buffer, which is freed when
the user's command is finished, thus it dangles afterwards. When next a
command is sent by the user that has a smaller/similar CDB as
BLK_MAX_CDB, bsg will assume that scsi_request->cmd is backed by
scsi_request->__cmd, will not make a custom allocation, and write into
undefined memory.

Fix this by splitting bsg_init_rq() into two functions:
 - bsg_init_rq() is changed to only do the allocation of the
   sense-buffer, which is used to back the bsg job's reply buffer. This
   pointer should never change during the lifetime of a scsi_request, so
   it doesn't need re-initialization.
 - bsg_initialize_rq() is a new function that makes use of
   'struct request_queue's initialize_rq_fn callback (which was
   introduced in v4.12). This is always called before the request is
   given out via blk_get_request(). This function does the remaining
   initialization that was previously done in bsg_init_rq(), and will
   also do it when the request is taken from the emergency-pool of the
   backing mempool.

Fixes: 50b4d48552 ("bsg-lib: fix kernel panic resulting from missing allocation of reply-buffer")
Cc: <stable@vger.kernel.org> # 4.11+
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Benjamin Block <bblock@linux.vnet.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2017-10-04 08:35:04 -06:00
..
partitions partitions/ldm: switch to use uuid_t 2017-06-05 16:59:14 +02:00
badblocks.c block: Add fallthrough markers to switch statements 2017-06-21 11:46:07 -06:00
bfq-cgroup.c bfq: Declare local functions static 2017-09-01 13:56:37 -06:00
bfq-iosched.c Merge branch 'for-4.14/block-postmerge' of git://git.kernel.dk/linux-block 2017-09-09 12:49:01 -07:00
bfq-iosched.h Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block 2017-09-07 11:59:42 -07:00
bfq-wf2q.c block, bfq: guarantee update_next_in_service always returns an eligible entity 2017-08-31 08:20:31 -06:00
bio-integrity.c Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block 2017-09-07 11:59:42 -07:00
bio.c Merge tag 'md/4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md 2017-09-07 12:41:48 -07:00
blk-cgroup.c blkcg: avoid free blkcg_root when failed to alloc blkcg policy 2017-08-25 13:51:07 -06:00
blk-core.c blktrace: Fix potential deadlock between delete & sysfs ops 2017-09-25 08:56:05 -06:00
blk-exec.c block: introduce new block status code type 2017-06-09 09:27:32 -06:00
blk-flush.c block: update comments to reflect REQ_FLUSH -> REQ_PREFLUSH rename 2017-08-25 10:36:54 -06:00
blk-integrity.c block: switch bios to blk_status_t 2017-06-09 09:27:32 -06:00
blk-ioc.c Merge branch 'for-linus' of git://git.kernel.dk/linux-block 2017-03-03 10:53:35 -08:00
blk-lib.c block: fix integer overflow in __blkdev_sectors_to_bio_pages() 2017-09-11 09:46:49 -06:00
blk-map.c blk-map: call blk_queue_bounce from blk_rq_append_bio 2017-06-27 12:13:21 -06:00
blk-merge.c block: replace bi_bdev with a gendisk pointer and partitions index 2017-08-23 12:49:55 -06:00
blk-mq-cpumap.c blk-mq: map queues to all present CPUs 2017-07-24 10:01:31 -06:00
blk-mq-debugfs.c blk-mq-debugfs: fix device sched directory for default scheduler 2017-10-03 15:58:55 -06:00
blk-mq-debugfs.h mq-deadline: add debugfs attributes 2017-05-04 08:25:17 -06:00
blk-mq-pci.c blk-mq-pci: add a fallback when pci_irq_get_affinity returns NULL 2017-08-18 08:08:14 -06:00
blk-mq-rdma.c block: Add rdma affinity based queue mapping helper 2017-08-08 14:58:03 -04:00
blk-mq-sched.c blk-mq-sched: fix performance regression of mq-deadline 2017-07-03 16:54:09 -06:00
blk-mq-sched.h Merge commit '8e8320c9315c' into for-4.13/block 2017-06-22 21:55:24 -06:00
blk-mq-sysfs.c blk-mq: untangle debugfs and sysfs 2017-05-04 08:24:13 -06:00
blk-mq-tag.c blk-mq: Make blk_mq_reinit_tagset() calls easier to read 2017-08-18 08:36:58 -06:00
blk-mq-tag.h blk-mq-sched: Allocate sched reserved tags as specified in the original queue tagset 2017-03-02 08:56:04 -07:00
blk-mq-virtio.c blk-mq: provide a default queue mapping for virtio device 2017-02-27 20:54:05 +02:00
blk-mq.c block: directly insert blk-mq request from blk_insert_cloned_request() 2017-09-11 16:43:57 -06:00
blk-mq.h block: directly insert blk-mq request from blk_insert_cloned_request() 2017-09-11 16:43:57 -06:00
blk-settings.c block: Warn if blk_queue_rq_timed_out() is called for a blk-mq queue 2017-08-23 12:02:30 -06:00
blk-softirq.c smp: Avoid using two cache lines for struct call_single_data 2017-08-29 15:14:38 +02:00
blk-stat.c blk-stat: don't use this_cpu_ptr() in a preemptable section 2017-05-10 07:40:18 -06:00
blk-stat.h blk-stat: kill blk_stat_rq_ddir() 2017-04-21 07:56:23 -06:00
blk-sysfs.c block: fix warning when I/O elevator is changed as request_queue is being removed 2017-08-28 10:52:44 -06:00
blk-tag.c block: Unexport blk_queue_end_tag() 2017-08-18 08:36:58 -06:00
blk-throttle.c blk-throttle: fix possible io stall when upgrade to max 2017-10-03 15:41:55 -06:00
blk-timeout.c block: Check locking assumptions at runtime 2017-06-20 19:27:14 -06:00
blk-wbt.c sched/wait: Disambiguate wq_entry->task_list and wq_head->task_list naming 2017-06-20 12:19:14 +02:00
blk-wbt.h block: Make writeback throttling defaults consistent for SQ devices 2017-04-19 08:49:03 -06:00
blk-zoned.c block: replace bi_bdev with a gendisk pointer and partitions index 2017-08-23 12:49:55 -06:00
blk.h block: Make blk_dequeue_request() static 2017-08-29 09:49:31 -06:00
bounce.c block: remove the queue_bounce_pfn helper 2017-06-27 12:13:45 -06:00
bsg-lib.c bsg-lib: fix use-after-free under memory-pressure 2017-10-04 08:35:04 -06:00
bsg.c bsg: remove #if 0'ed code 2017-08-29 10:50:30 -06:00
cfq-iosched.c block/cfq: cache rightmost rb_node 2017-09-08 18:26:49 -07:00
cmdline-parser.c block: remove unrelated header files and export symbol 2014-01-21 20:18:26 -08:00
compat_ioctl.c compat_hdio_ioctl: Fix a declaration 2017-08-31 17:32:41 -04:00
deadline-iosched.c block, scheduler: convert xxx_var_store to void 2017-08-28 10:01:08 -06:00
elevator.c block: fix warning when I/O elevator is changed as request_queue is being removed 2017-08-28 10:52:44 -06:00
genhd.c Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block 2017-09-07 11:59:42 -07:00
ioctl.c block: remove the discard_zeroes_data flag 2017-04-08 11:25:38 -06:00
ioprio.c block: Add fallthrough markers to switch statements 2017-06-21 11:46:07 -06:00
Kconfig block: Add rdma affinity based queue mapping helper 2017-08-08 14:58:03 -04:00
Kconfig.iosched block, bfq: add full hierarchical scheduling and cgroups support 2017-04-19 08:30:26 -06:00
kyber-iosched.c Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2017-07-03 13:08:04 -07:00
Makefile block: Add rdma affinity based queue mapping helper 2017-08-08 14:58:03 -04:00
mq-deadline.c mq-deadline: Enable auto-loading when built as module 2017-08-29 10:47:23 -06:00
noop-iosched.c block: move existing elevator ops to union 2017-01-17 10:03:33 -07:00
opal_proto.h block: sed-opal: Set MBRDone on S3 resume path if TPER is MBREnabled 2017-09-11 09:45:52 -06:00
partition-generic.c block: fix a crash caused by wrong API 2017-09-25 08:56:05 -06:00
scsi_ioctl.c block: Change argument type of scsi_req_init() 2017-06-20 19:27:14 -06:00
sed-opal.c block: sed-opal: Set MBRDone on S3 resume path if TPER is MBREnabled 2017-09-11 09:45:52 -06:00
t10-pi.c t10-pi: Move opencoded contants to common header 2017-07-03 16:56:25 -06:00