No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Coly Li 62e7e4f597 bcache: fix refcount underflow in bcache_device_free()
[ Upstream commit 86da9f736740eba602389908574dfbb0f517baa5 ]

The problematic code piece in bcache_device_free() is,

 785 static void bcache_device_free(struct bcache_device *d)
 786 {
 787     struct gendisk *disk = d->disk;
 [snipped]
 799     if (disk) {
 800             if (disk->flags & GENHD_FL_UP)
 801                     del_gendisk(disk);
 802
 803             if (disk->queue)
 804                     blk_cleanup_queue(disk->queue);
 805
 806             ida_simple_remove(&bcache_device_idx,
 807                               first_minor_to_idx(disk->first_minor));
 808             put_disk(disk);
 809         }
 [snipped]
 816 }

At line 808, put_disk(disk) may encounter kobject refcount of 'disk'
being underflow.

Here is how to reproduce the issue,
- Attche the backing device to a cache device and do random write to
  make the cache being dirty.
- Stop the bcache device while the cache device has dirty data of the
  backing device.
- Only register the backing device back, NOT register cache device.
- The bcache device node /dev/bcache0 won't show up, because backing
  device waits for the cache device shows up for the missing dirty
  data.
- Now echo 1 into /sys/fs/bcache/pendings_cleanup, to stop the pending
  backing device.
- After the pending backing device stopped, use 'dmesg' to check kernel
  message, a use-after-free warning from KASA reported the refcount of
  kobject linked to the 'disk' is underflow.

The dropping refcount at line 808 in the above code piece is added by
add_disk(d->disk) in bch_cached_dev_run(). But in the above condition
the cache device is not registered, bch_cached_dev_run() has no chance
to be called and the refcount is not added. The put_disk() for a non-
added refcount of gendisk kobject triggers a underflow warning.

This patch checks whether GENHD_FL_UP is set in disk->flags, if it is
not set then the bcache device was not added, don't call put_disk()
and the the underflow issue can be avoided.

Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-06-22 09:31:09 +02:00
arch MIPS: Fix IRQ tracing when call handle_fpe() and handle_msa_fpe() 2020-06-22 09:31:09 +02:00
block iocost: don't let vrate run wild while there's no saturation signal 2020-06-22 09:31:06 +02:00
certs
crypto crypto: drbg - fix error return code in drbg_alloc_state() 2020-06-17 16:40:31 +02:00
Documentation dt-bindings: display: mediatek: control dpi pins mode to avoid leakage 2020-06-22 09:30:58 +02:00
drivers bcache: fix refcount underflow in bcache_device_free() 2020-06-22 09:31:09 +02:00
fs btrfs: qgroup: mark qgroup inconsistent if we're inherting snapshot to a new qgroup 2020-06-22 09:31:09 +02:00
include kgdb: Fix spurious true from in_dbg_master() 2020-06-22 09:31:03 +02:00
init x86: Fix early boot crash on gcc-10, third try 2020-05-20 08:20:34 +02:00
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index 2020-05-20 08:20:16 +02:00
kernel sched: Defend cfs and rt bandwidth quota against overflow 2020-06-22 09:31:07 +02:00
lib lib/mpi: Fix 64-bit MIPS build with Clang 2020-06-22 09:31:00 +02:00
LICENSES
mm mm/slub: fix a memory leak in sysfs_slab_add() 2020-06-17 16:40:36 +02:00
net netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported 2020-06-22 09:31:00 +02:00
samples samples: bpf: Fix build error 2020-06-03 08:21:15 +02:00
scripts bpf: Support llvm-objcopy for vmlinux BTF 2020-06-17 16:40:20 +02:00
security selinux: fix error return code in policydb_read() 2020-06-22 09:31:01 +02:00
sound ALSA: usb-audio: Add vendor, product and profile name for HP Thunderbolt Dock 2020-06-17 16:40:28 +02:00
tools selftests/bpf: CONFIG_IPV6_SEG6_BPF required for test_seg6_loop.o 2020-06-22 09:31:08 +02:00
usr
virt KVM: arm64: Save the host's PtrAuth keys in non-preemptible context 2020-06-17 16:40:38 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.47 2020-06-17 16:40:38 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.