linux/block
Benjamin Block eab40cf336 bsg-lib: fix use-after-free under memory-pressure
When under memory-pressure it is possible that the mempool which backs
the 'struct request_queue' will make use of up to BLKDEV_MIN_RQ count
emergency buffers - in case it can't get a regular allocation. These
buffers are preallocated and once they are also used, they are
re-supplied with old finished requests from the same request_queue (see
mempool_free()).

The bug is, when re-supplying the emergency pool, the old requests are
not again ran through the callback mempool_t->alloc(), and thus also not
through the callback bsg_init_rq(). Thus we skip initialization, and
while the sense-buffer still should be good, scsi_request->cmd might
have become to be an invalid pointer in the meantime. When the request
is initialized in bsg.c, and the user's CDB is larger than BLK_MAX_CDB,
bsg will replace it with a custom allocated buffer, which is freed when
the user's command is finished, thus it dangles afterwards. When next a
command is sent by the user that has a smaller/similar CDB as
BLK_MAX_CDB, bsg will assume that scsi_request->cmd is backed by
scsi_request->__cmd, will not make a custom allocation, and write into
undefined memory.

Fix this by splitting bsg_init_rq() into two functions:
 - bsg_init_rq() is changed to only do the allocation of the
   sense-buffer, which is used to back the bsg job's reply buffer. This
   pointer should never change during the lifetime of a scsi_request, so
   it doesn't need re-initialization.
 - bsg_initialize_rq() is a new function that makes use of
   'struct request_queue's initialize_rq_fn callback (which was
   introduced in v4.12). This is always called before the request is
   given out via blk_get_request(). This function does the remaining
   initialization that was previously done in bsg_init_rq(), and will
   also do it when the request is taken from the emergency-pool of the
   backing mempool.

Fixes: 50b4d48552 ("bsg-lib: fix kernel panic resulting from missing allocation of reply-buffer")
Cc: <stable@vger.kernel.org> # 4.11+
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Benjamin Block <bblock@linux.vnet.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2017-10-04 08:35:04 -06:00
..
partitions
badblocks.c
bfq-cgroup.c bfq: Declare local functions static 2017-09-01 13:56:37 -06:00
bfq-iosched.c Merge branch 'for-4.14/block-postmerge' of git://git.kernel.dk/linux-block 2017-09-09 12:49:01 -07:00
bfq-iosched.h Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block 2017-09-07 11:59:42 -07:00
bfq-wf2q.c block, bfq: guarantee update_next_in_service always returns an eligible entity 2017-08-31 08:20:31 -06:00
bio-integrity.c Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block 2017-09-07 11:59:42 -07:00
bio.c Merge tag 'md/4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md 2017-09-07 12:41:48 -07:00
blk-cgroup.c blkcg: avoid free blkcg_root when failed to alloc blkcg policy 2017-08-25 13:51:07 -06:00
blk-core.c blktrace: Fix potential deadlock between delete & sysfs ops 2017-09-25 08:56:05 -06:00
blk-exec.c
blk-flush.c block: update comments to reflect REQ_FLUSH -> REQ_PREFLUSH rename 2017-08-25 10:36:54 -06:00
blk-integrity.c
blk-ioc.c
blk-lib.c block: fix integer overflow in __blkdev_sectors_to_bio_pages() 2017-09-11 09:46:49 -06:00
blk-map.c
blk-merge.c block: replace bi_bdev with a gendisk pointer and partitions index 2017-08-23 12:49:55 -06:00
blk-mq-cpumap.c
blk-mq-debugfs.c blk-mq-debugfs: fix device sched directory for default scheduler 2017-10-03 15:58:55 -06:00
blk-mq-debugfs.h
blk-mq-pci.c
blk-mq-rdma.c
blk-mq-sched.c
blk-mq-sched.h
blk-mq-sysfs.c
blk-mq-tag.c
blk-mq-tag.h
blk-mq-virtio.c
blk-mq.c block: directly insert blk-mq request from blk_insert_cloned_request() 2017-09-11 16:43:57 -06:00
blk-mq.h block: directly insert blk-mq request from blk_insert_cloned_request() 2017-09-11 16:43:57 -06:00
blk-settings.c
blk-softirq.c smp: Avoid using two cache lines for struct call_single_data 2017-08-29 15:14:38 +02:00
blk-stat.c
blk-stat.h
blk-sysfs.c block: fix warning when I/O elevator is changed as request_queue is being removed 2017-08-28 10:52:44 -06:00
blk-tag.c
blk-throttle.c blk-throttle: fix possible io stall when upgrade to max 2017-10-03 15:41:55 -06:00
blk-timeout.c
blk-wbt.c
blk-wbt.h
blk-zoned.c block: replace bi_bdev with a gendisk pointer and partitions index 2017-08-23 12:49:55 -06:00
blk.h block: Make blk_dequeue_request() static 2017-08-29 09:49:31 -06:00
bounce.c
bsg-lib.c bsg-lib: fix use-after-free under memory-pressure 2017-10-04 08:35:04 -06:00
bsg.c bsg: remove #if 0'ed code 2017-08-29 10:50:30 -06:00
cfq-iosched.c block/cfq: cache rightmost rb_node 2017-09-08 18:26:49 -07:00
cmdline-parser.c
compat_ioctl.c compat_hdio_ioctl: Fix a declaration 2017-08-31 17:32:41 -04:00
deadline-iosched.c block, scheduler: convert xxx_var_store to void 2017-08-28 10:01:08 -06:00
elevator.c block: fix warning when I/O elevator is changed as request_queue is being removed 2017-08-28 10:52:44 -06:00
genhd.c Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block 2017-09-07 11:59:42 -07:00
ioctl.c
ioprio.c
Kconfig
Kconfig.iosched
kyber-iosched.c
Makefile
mq-deadline.c mq-deadline: Enable auto-loading when built as module 2017-08-29 10:47:23 -06:00
noop-iosched.c
opal_proto.h block: sed-opal: Set MBRDone on S3 resume path if TPER is MBREnabled 2017-09-11 09:45:52 -06:00
partition-generic.c block: fix a crash caused by wrong API 2017-09-25 08:56:05 -06:00
scsi_ioctl.c
sed-opal.c block: sed-opal: Set MBRDone on S3 resume path if TPER is MBREnabled 2017-09-11 09:45:52 -06:00
t10-pi.c