Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Ilya Dryomov 9787b328c4 rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails ... commit f7c4d9b133c7a04ca619355574e96b6abf209fba upstream. If getting an ID or setting up a work queue in rbd_dev_create() fails, use-after-free on rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts is triggered in do_rbd_add(). The root cause is that the ownership of these structures is transfered to rbd_dev prematurely and they all end up getting freed when rbd_dev_create() calls rbd_dev_free() prior to returning to do_rbd_add(). Found by Linux Verification Center (linuxtesting.org) with SVACE, an incomplete patch submitted by Natalia Petrova <n.petrova@fintech.ru>. Cc: stable@vger.kernel.org Fixes: 1643dfa4c2 ("rbd: introduce a per-device ordered workqueue") Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-03-11 16:44:04 +01:00
..
aoe
drbd	drbd: use after free in drbd_create_device()	2022-11-25 17:42:16 +01:00
mtip32xx
paride
rsxx
xen-blkback
zram
amiflop.c
ataflop.c
brd.c
cryptoloop.c
floppy.c	floppy: use a statically allocated error counter	2022-05-25 09:14:31 +02:00
Kconfig	floppy: disable FDRAWCMD by default	2022-05-09 09:03:20 +02:00
loop.c	loop: Check for overflow while configuring loop	2022-09-05 10:27:43 +02:00
loop.h
Makefile
nbd.c	nbd: Fix hung when signal interrupts nbd_start_device_ioctl()	2022-10-26 13:22:56 +02:00
null_blk.h
null_blk_main.c	null_blk: fix ida error handling in null_add_dev()	2022-08-25 11:17:59 +02:00
null_blk_zoned.c
pktcdvd.c
ps3disk.c
ps3vram.c
rbd.c	rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails	2023-03-11 16:44:04 +01:00
rbd_types.h
skd_main.c
skd_s1120.h
sunvdc.c
swim.c
swim3.c
swim_asm.S
sx8.c
umem.c
umem.h
virtio_blk.c	virtio_blk: fix the discard_granularity and discard_alignment queue limits	2022-06-14 18:11:35 +02:00
xen-blkfront.c	xen/blkfront: force data bouncing when backend is untrusted	2022-07-07 17:36:53 +02:00
xsysace.c
z2ram.c