From: colyli@suse.de
To: axboe@kernel.dk
Cc: linux-bcache@vger.kernel.org, linux-block@vger.kernel.org,
Coly Li <colyli@suse.de>, Christoph Hellwig <hch@lst.de>
Subject: [PATCH 05/17] bcache: fix use-after-free in register_bcache()
Date: Fri, 24 Jan 2020 01:01:30 +0800 [thread overview]
Message-ID: <20200123170142.98974-6-colyli@suse.de> (raw)
In-Reply-To: <20200123170142.98974-1-colyli@suse.de>
From: Coly Li <colyli@suse.de>
The patch "bcache: rework error unwinding in register_bcache" introduces
a use-after-free regression in register_bcache(). Here are current code,
2510 out_free_path:
2511 kfree(path);
2512 out_module_put:
2513 module_put(THIS_MODULE);
2514 out:
2515 pr_info("error %s: %s", path, err);
2516 return ret;
If some error happens and the above code path is executed, at line 2511
path is released, but referenced at line 2515. Then KASAN reports a use-
after-free error message.
This patch changes line 2515 in the following way to fix the problem,
2515 pr_info("error %s: %s", path?path:"", err);
Signed-off-by: Coly Li <colyli@suse.de>
Cc: Christoph Hellwig <hch@lst.de>
---
drivers/md/bcache/super.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index ee7c87f38d0d..fad9c6cbee5e 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -2477,10 +2477,11 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
kfree(sb);
out_free_path:
kfree(path);
+ path = NULL;
out_module_put:
module_put(THIS_MODULE);
out:
- pr_info("error %s: %s", path, err);
+ pr_info("error %s: %s", path?path:"", err);
return ret;
}
--
2.16.4
next prev parent reply other threads:[~2020-01-23 17:02 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-23 17:01 [PATCH 00/17] bcache patches for Linux v5.6 colyli
2020-01-23 17:01 ` [PATCH 01/17] bcache: cached_dev_free needs to put the sb page colyli
2020-01-23 17:01 ` [PATCH 02/17] bcache: use a separate data structure for the on-disk super block colyli
2020-01-23 17:01 ` [PATCH 03/17] bcache: rework error unwinding in register_bcache colyli
2020-01-23 17:01 ` [PATCH 04/17] bcache: properly initialize 'path' and 'err' in register_bcache() colyli
2020-01-23 17:01 ` colyli [this message]
2020-01-23 17:01 ` [PATCH 06/17] bcache: transfer the sb_page reference to register_{bdev,cache} colyli
2020-01-23 17:01 ` [PATCH 07/17] bcache: return a pointer to the on-disk sb from read_super colyli
2020-01-23 17:01 ` [PATCH 08/17] bcache: store a pointer to the on-disk sb in the cache and cached_dev structures colyli
2020-01-23 17:01 ` [PATCH 09/17] bcache: use read_cache_page_gfp to read the superblock colyli
2020-01-23 17:01 ` [PATCH 10/17] lib: crc64: include <linux/crc64.h> for 'crc64_be' colyli
2020-01-23 17:01 ` [PATCH 11/17] bcache: add code comments for state->pool in __btree_sort() colyli
2020-01-23 17:01 ` [PATCH 12/17] bcache: avoid unnecessary btree nodes flushing in btree_flush_write() colyli
2020-01-23 17:01 ` [PATCH 13/17] bcache: print written and keys in trace_bcache_btree_write colyli
2020-01-23 17:01 ` [PATCH 14/17] bcache: back to cache all readahead I/Os colyli
2020-01-23 17:19 ` Michael Lyle
2020-01-23 17:27 ` Coly Li
2020-01-23 18:31 ` Jens Axboe
2020-01-24 0:49 ` Coly Li
2020-01-24 1:14 ` Jens Axboe
2020-01-24 16:48 ` Michael Lyle
2020-01-23 17:01 ` [PATCH 15/17] bcache: remove member accessed from struct btree colyli
2020-01-23 17:01 ` [PATCH 16/17] bcache: reap c->btree_cache_freeable from the tail in bch_mca_scan() colyli
2020-01-23 17:01 ` [PATCH 17/17] bcache: reap from tail of c->btree_cache " colyli
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200123170142.98974-6-colyli@suse.de \
--to=colyli@suse.de \
--cc=axboe@kernel.dk \
--cc=hch@lst.de \
--cc=linux-bcache@vger.kernel.org \
--cc=linux-block@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox