Re: [PATCH v4] virtio-blk: handle block_device_operations callbacks after hot unplug
On Mon, May 04, 2020 at 01:48:34PM +0200, Cornelia Huck wrote:
> On Thu, 30 Apr 2020 15:04:42 +0100
> Stefan Hajnoczi wrote:
>
> > A userspace process holding a file descriptor to a virtio_blk device can
> > still invoke block_device_operations after hot unplug. This leads to a
> > use-after-free accessing vblk->vdev in virtblk_getgeo() when
> > ioctl(HDIO_GETGEO) is invoked:
> >
> > BUG: unable to handle kernel NULL pointer dereference at 0090
> > IP: [] virtio_check_driver_offered_feature+0x10/0x90
> > [virtio]
> > PGD 80003a92f067 PUD 3a930067 PMD 0
> > Oops: [#1] SMP
> > CPU: 0 PID: 1310 Comm: hdio-getgeo Tainted: G OE
> > 3.10.0-1062.el7.x86_64 #1
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> > rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
> > task: 9be5fbfb8000 ti: 9be5fa89 task.ti: 9be5fa89
> > RIP: 0010:[] []
> > virtio_check_driver_offered_feature+0x10/0x90 [virtio]
> > RSP: 0018:9be5fa893dc8 EFLAGS: 00010246
> > RAX: 9be5fc3f3400 RBX: 9be5fa893e30 RCX:
> > RDX: RSI: 0004 RDI: 9be5fbc10b40
> > RBP: 9be5fa893dc8 R08: 0301 R09: 0301
> > R10: R11: R12: 9be5fdc24680
> > R13: 9be5fbc10b40 R14: 9be5fbc10480 R15:
> > FS: 7f1bfb968740() GS:9be5ffc0()
> > knlGS:
> > CS: 0010 DS: ES: CR0: 80050033
> > CR2: 0090 CR3: 3a894000 CR4: 00360ff0
> > DR0: DR1: DR2:
> > DR3: DR6: fffe0ff0 DR7: 0400
> > Call Trace:
> >[] virtblk_getgeo+0x47/0x110 [virtio_blk]
> >[] ? handle_mm_fault+0x39d/0x9b0
> >[] blkdev_ioctl+0x1f5/0xa20
> >[] block_ioctl+0x41/0x50
> >[] do_vfs_ioctl+0x3a0/0x5a0
> >[] SyS_ioctl+0xa1/0xc0
> >
> > A related problem is that virtblk_remove() leaks the vd_index_ida index
> > when something still holds a reference to vblk->disk during hot unplug.
> > This causes virtio-blk device names to be lost (vda, vdb, etc).
> >
> > Fix these issues by protecting vblk->vdev with a mutex and reference
> > counting vblk so the vd_index_ida index can be removed in all cases.
> >
> > Fixes: 48e4043d4529523cbc7fa8dd745bd8e2c45ce1d3
> >("virtio: add virtio disk geometry feature")
>
> Should be
>
> Fixes: 48e4043d4529 ("virtio: add virtio disk geometry feature")
Yes - it was reported on linux-next so I fixed it up when applying.
> > Reported-by: Lance Digby
> > Signed-off-by: Stefan Hajnoczi
> > ---
> > v4:
> > * Clarify vdev_mutex usage [Stefano and Michael]
> >
> > drivers/block/virtio_blk.c | 86 ++
> > 1 file changed, 78 insertions(+), 8 deletions(-)
> >
> > diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
> > index 93468b7c6701..9d21bf0f155e 100644
> > --- a/drivers/block/virtio_blk.c
> > +++ b/drivers/block/virtio_blk.c
> > @@ -33,6 +33,15 @@ struct virtio_blk_vq {
> > } cacheline_aligned_in_smp;
> >
> > struct virtio_blk {
> > + /*
> > +* This mutex must be held by anything that may run after
> > +* virtblk_remove() sets vblk->vdev to NULL.
> > +*
> > +* blk-mq, virtqueue processing, and sysfs attribute code paths are
> > +* shut down before vblk->vdev is set to NULL and therefore do not need
> > +* to hold this mutex.
> > +*/
> > + struct mutex vdev_mutex;
> > struct virtio_device *vdev;
> >
> > /* The disk structure for the kernel. */
> > @@ -44,6 +53,13 @@ struct virtio_blk {
> > /* Process context for config space updates */
> > struct work_struct config_work;
> >
> > + /*
> > +* Tracks references from block_device_operations open/release and
> > +* virtio_driver probe/remove so this object can be freed once no
> > +* longer in use.
> > +*/
> > + refcount_t refs;
>
> Using a struct kref might be more idiomatic.
>
> > +
> > /* What host tells us, plus 2 for header & tailer. */
> > unsigned int sg_elems;
> >
> > @@ -295,10 +311,55 @@ static int virtblk_get_id(struct gendisk *disk, char
> > *id_str)
> > return err;
> > }
> >
> > +static void virtblk_get(struct virtio_blk *vblk)
> > +{
> > + refcount_inc(>refs);
>
> Should the code even be able to grab a ref if !vblk->vdev?
>
> > +}
> > +
> > +static void virtblk_put(struct virtio_blk *vblk)
> > +{
> > + if (refcount_dec_and_test(>refs)) {
> > + ida_simple_remove(_index_ida, vblk->index);
> > + mutex_destroy(>vdev_mutex);
> > + kfree(vblk);
>
> I think that's where putting these cleanups into a release() funtion
> would be more idiomatic.
>
> > + }
> > +}
>
> (...)
>
> Looks sane to me.
Re: [PATCH v4] virtio-blk: handle block_device_operations callbacks after hot unplug
On Thu, 30 Apr 2020 15:04:42 +0100
Stefan Hajnoczi wrote:
> A userspace process holding a file descriptor to a virtio_blk device can
> still invoke block_device_operations after hot unplug. This leads to a
> use-after-free accessing vblk->vdev in virtblk_getgeo() when
> ioctl(HDIO_GETGEO) is invoked:
>
> BUG: unable to handle kernel NULL pointer dereference at 0090
> IP: [] virtio_check_driver_offered_feature+0x10/0x90
> [virtio]
> PGD 80003a92f067 PUD 3a930067 PMD 0
> Oops: [#1] SMP
> CPU: 0 PID: 1310 Comm: hdio-getgeo Tainted: G OE
> 3.10.0-1062.el7.x86_64 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
> task: 9be5fbfb8000 ti: 9be5fa89 task.ti: 9be5fa89
> RIP: 0010:[] []
> virtio_check_driver_offered_feature+0x10/0x90 [virtio]
> RSP: 0018:9be5fa893dc8 EFLAGS: 00010246
> RAX: 9be5fc3f3400 RBX: 9be5fa893e30 RCX:
> RDX: RSI: 0004 RDI: 9be5fbc10b40
> RBP: 9be5fa893dc8 R08: 0301 R09: 0301
> R10: R11: R12: 9be5fdc24680
> R13: 9be5fbc10b40 R14: 9be5fbc10480 R15:
> FS: 7f1bfb968740() GS:9be5ffc0() knlGS:
> CS: 0010 DS: ES: CR0: 80050033
> CR2: 0090 CR3: 3a894000 CR4: 00360ff0
> DR0: DR1: DR2:
> DR3: DR6: fffe0ff0 DR7: 0400
> Call Trace:
>[] virtblk_getgeo+0x47/0x110 [virtio_blk]
>[] ? handle_mm_fault+0x39d/0x9b0
>[] blkdev_ioctl+0x1f5/0xa20
>[] block_ioctl+0x41/0x50
>[] do_vfs_ioctl+0x3a0/0x5a0
>[] SyS_ioctl+0xa1/0xc0
>
> A related problem is that virtblk_remove() leaks the vd_index_ida index
> when something still holds a reference to vblk->disk during hot unplug.
> This causes virtio-blk device names to be lost (vda, vdb, etc).
>
> Fix these issues by protecting vblk->vdev with a mutex and reference
> counting vblk so the vd_index_ida index can be removed in all cases.
>
> Fixes: 48e4043d4529523cbc7fa8dd745bd8e2c45ce1d3
>("virtio: add virtio disk geometry feature")
Should be
Fixes: 48e4043d4529 ("virtio: add virtio disk geometry feature")
> Reported-by: Lance Digby
> Signed-off-by: Stefan Hajnoczi
> ---
> v4:
> * Clarify vdev_mutex usage [Stefano and Michael]
>
> drivers/block/virtio_blk.c | 86 ++
> 1 file changed, 78 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
> index 93468b7c6701..9d21bf0f155e 100644
> --- a/drivers/block/virtio_blk.c
> +++ b/drivers/block/virtio_blk.c
> @@ -33,6 +33,15 @@ struct virtio_blk_vq {
> } cacheline_aligned_in_smp;
>
> struct virtio_blk {
> + /*
> + * This mutex must be held by anything that may run after
> + * virtblk_remove() sets vblk->vdev to NULL.
> + *
> + * blk-mq, virtqueue processing, and sysfs attribute code paths are
> + * shut down before vblk->vdev is set to NULL and therefore do not need
> + * to hold this mutex.
> + */
> + struct mutex vdev_mutex;
> struct virtio_device *vdev;
>
> /* The disk structure for the kernel. */
> @@ -44,6 +53,13 @@ struct virtio_blk {
> /* Process context for config space updates */
> struct work_struct config_work;
>
> + /*
> + * Tracks references from block_device_operations open/release and
> + * virtio_driver probe/remove so this object can be freed once no
> + * longer in use.
> + */
> + refcount_t refs;
Using a struct kref might be more idiomatic.
> +
> /* What host tells us, plus 2 for header & tailer. */
> unsigned int sg_elems;
>
> @@ -295,10 +311,55 @@ static int virtblk_get_id(struct gendisk *disk, char
> *id_str)
> return err;
> }
>
> +static void virtblk_get(struct virtio_blk *vblk)
> +{
> + refcount_inc(>refs);
Should the code even be able to grab a ref if !vblk->vdev?
> +}
> +
> +static void virtblk_put(struct virtio_blk *vblk)
> +{
> + if (refcount_dec_and_test(>refs)) {
> + ida_simple_remove(_index_ida, vblk->index);
> + mutex_destroy(>vdev_mutex);
> + kfree(vblk);
I think that's where putting these cleanups into a release() funtion
would be more idiomatic.
> + }
> +}
(...)
Looks sane to me.
Re: [PATCH v4] virtio-blk: handle block_device_operations callbacks after hot unplug
On Thu, Apr 30, 2020 at 03:04:42PM +0100, Stefan Hajnoczi wrote:
> A userspace process holding a file descriptor to a virtio_blk device can
> still invoke block_device_operations after hot unplug. This leads to a
> use-after-free accessing vblk->vdev in virtblk_getgeo() when
> ioctl(HDIO_GETGEO) is invoked:
>
> BUG: unable to handle kernel NULL pointer dereference at 0090
> IP: [] virtio_check_driver_offered_feature+0x10/0x90
> [virtio]
> PGD 80003a92f067 PUD 3a930067 PMD 0
> Oops: [#1] SMP
> CPU: 0 PID: 1310 Comm: hdio-getgeo Tainted: G OE
> 3.10.0-1062.el7.x86_64 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
> task: 9be5fbfb8000 ti: 9be5fa89 task.ti: 9be5fa89
> RIP: 0010:[] []
> virtio_check_driver_offered_feature+0x10/0x90 [virtio]
> RSP: 0018:9be5fa893dc8 EFLAGS: 00010246
> RAX: 9be5fc3f3400 RBX: 9be5fa893e30 RCX:
> RDX: RSI: 0004 RDI: 9be5fbc10b40
> RBP: 9be5fa893dc8 R08: 0301 R09: 0301
> R10: R11: R12: 9be5fdc24680
> R13: 9be5fbc10b40 R14: 9be5fbc10480 R15:
> FS: 7f1bfb968740() GS:9be5ffc0() knlGS:
> CS: 0010 DS: ES: CR0: 80050033
> CR2: 0090 CR3: 3a894000 CR4: 00360ff0
> DR0: DR1: DR2:
> DR3: DR6: fffe0ff0 DR7: 0400
> Call Trace:
>[] virtblk_getgeo+0x47/0x110 [virtio_blk]
>[] ? handle_mm_fault+0x39d/0x9b0
>[] blkdev_ioctl+0x1f5/0xa20
>[] block_ioctl+0x41/0x50
>[] do_vfs_ioctl+0x3a0/0x5a0
>[] SyS_ioctl+0xa1/0xc0
>
> A related problem is that virtblk_remove() leaks the vd_index_ida index
> when something still holds a reference to vblk->disk during hot unplug.
> This causes virtio-blk device names to be lost (vda, vdb, etc).
>
> Fix these issues by protecting vblk->vdev with a mutex and reference
> counting vblk so the vd_index_ida index can be removed in all cases.
>
> Fixes: 48e4043d4529523cbc7fa8dd745bd8e2c45ce1d3
>("virtio: add virtio disk geometry feature")
> Reported-by: Lance Digby
> Signed-off-by: Stefan Hajnoczi
> ---
> v4:
> * Clarify vdev_mutex usage [Stefano and Michael]
>
> drivers/block/virtio_blk.c | 86 ++
> 1 file changed, 78 insertions(+), 8 deletions(-)
Reviewed-by: Stefano Garzarella
Thanks,
Stefano
>
> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
> index 93468b7c6701..9d21bf0f155e 100644
> --- a/drivers/block/virtio_blk.c
> +++ b/drivers/block/virtio_blk.c
> @@ -33,6 +33,15 @@ struct virtio_blk_vq {
> } cacheline_aligned_in_smp;
>
> struct virtio_blk {
> + /*
> + * This mutex must be held by anything that may run after
> + * virtblk_remove() sets vblk->vdev to NULL.
> + *
> + * blk-mq, virtqueue processing, and sysfs attribute code paths are
> + * shut down before vblk->vdev is set to NULL and therefore do not need
> + * to hold this mutex.
> + */
> + struct mutex vdev_mutex;
> struct virtio_device *vdev;
>
> /* The disk structure for the kernel. */
> @@ -44,6 +53,13 @@ struct virtio_blk {
> /* Process context for config space updates */
> struct work_struct config_work;
>
> + /*
> + * Tracks references from block_device_operations open/release and
> + * virtio_driver probe/remove so this object can be freed once no
> + * longer in use.
> + */
> + refcount_t refs;
> +
> /* What host tells us, plus 2 for header & tailer. */
> unsigned int sg_elems;
>
> @@ -295,10 +311,55 @@ static int virtblk_get_id(struct gendisk *disk, char
> *id_str)
> return err;
> }
>
> +static void virtblk_get(struct virtio_blk *vblk)
> +{
> + refcount_inc(>refs);
> +}
> +
> +static void virtblk_put(struct virtio_blk *vblk)
> +{
> + if (refcount_dec_and_test(>refs)) {
> + ida_simple_remove(_index_ida, vblk->index);
> + mutex_destroy(>vdev_mutex);
> + kfree(vblk);
> + }
> +}
> +
> +static int virtblk_open(struct block_device *bd, fmode_t mode)
> +{
> + struct virtio_blk *vblk = bd->bd_disk->private_data;
> + int ret = 0;
> +
> + mutex_lock(>vdev_mutex);
> +
> + if (vblk->vdev)
> + virtblk_get(vblk);
> + else
> + ret = -ENXIO;
> +
> + mutex_unlock(>vdev_mutex);
> + return ret;
> +}
> +
> +static void virtblk_release(struct gendisk *disk, fmode_t mode)
> +{
> + struct virtio_blk *vblk = disk->private_data;
> +
> + virtblk_put(vblk);
> +}
> +
> /* We provide getgeo only to please some old bootloader/partitioning tools */
> static int virtblk_getgeo(struct
[PATCH v4] virtio-blk: handle block_device_operations callbacks after hot unplug
A userspace process holding a file descriptor to a virtio_blk device can
still invoke block_device_operations after hot unplug. This leads to a
use-after-free accessing vblk->vdev in virtblk_getgeo() when
ioctl(HDIO_GETGEO) is invoked:
BUG: unable to handle kernel NULL pointer dereference at 0090
IP: [] virtio_check_driver_offered_feature+0x10/0x90
[virtio]
PGD 80003a92f067 PUD 3a930067 PMD 0
Oops: [#1] SMP
CPU: 0 PID: 1310 Comm: hdio-getgeo Tainted: G OE
3.10.0-1062.el7.x86_64 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
task: 9be5fbfb8000 ti: 9be5fa89 task.ti: 9be5fa89
RIP: 0010:[] []
virtio_check_driver_offered_feature+0x10/0x90 [virtio]
RSP: 0018:9be5fa893dc8 EFLAGS: 00010246
RAX: 9be5fc3f3400 RBX: 9be5fa893e30 RCX:
RDX: RSI: 0004 RDI: 9be5fbc10b40
RBP: 9be5fa893dc8 R08: 0301 R09: 0301
R10: R11: R12: 9be5fdc24680
R13: 9be5fbc10b40 R14: 9be5fbc10480 R15:
FS: 7f1bfb968740() GS:9be5ffc0() knlGS:
CS: 0010 DS: ES: CR0: 80050033
CR2: 0090 CR3: 3a894000 CR4: 00360ff0
DR0: DR1: DR2:
DR3: DR6: fffe0ff0 DR7: 0400
Call Trace:
[] virtblk_getgeo+0x47/0x110 [virtio_blk]
[] ? handle_mm_fault+0x39d/0x9b0
[] blkdev_ioctl+0x1f5/0xa20
[] block_ioctl+0x41/0x50
[] do_vfs_ioctl+0x3a0/0x5a0
[] SyS_ioctl+0xa1/0xc0
A related problem is that virtblk_remove() leaks the vd_index_ida index
when something still holds a reference to vblk->disk during hot unplug.
This causes virtio-blk device names to be lost (vda, vdb, etc).
Fix these issues by protecting vblk->vdev with a mutex and reference
counting vblk so the vd_index_ida index can be removed in all cases.
Fixes: 48e4043d4529523cbc7fa8dd745bd8e2c45ce1d3
("virtio: add virtio disk geometry feature")
Reported-by: Lance Digby
Signed-off-by: Stefan Hajnoczi
---
v4:
* Clarify vdev_mutex usage [Stefano and Michael]
drivers/block/virtio_blk.c | 86 ++
1 file changed, 78 insertions(+), 8 deletions(-)
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 93468b7c6701..9d21bf0f155e 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -33,6 +33,15 @@ struct virtio_blk_vq {
} cacheline_aligned_in_smp;
struct virtio_blk {
+ /*
+* This mutex must be held by anything that may run after
+* virtblk_remove() sets vblk->vdev to NULL.
+*
+* blk-mq, virtqueue processing, and sysfs attribute code paths are
+* shut down before vblk->vdev is set to NULL and therefore do not need
+* to hold this mutex.
+*/
+ struct mutex vdev_mutex;
struct virtio_device *vdev;
/* The disk structure for the kernel. */
@@ -44,6 +53,13 @@ struct virtio_blk {
/* Process context for config space updates */
struct work_struct config_work;
+ /*
+* Tracks references from block_device_operations open/release and
+* virtio_driver probe/remove so this object can be freed once no
+* longer in use.
+*/
+ refcount_t refs;
+
/* What host tells us, plus 2 for header & tailer. */
unsigned int sg_elems;
@@ -295,10 +311,55 @@ static int virtblk_get_id(struct gendisk *disk, char
*id_str)
return err;
}
+static void virtblk_get(struct virtio_blk *vblk)
+{
+ refcount_inc(>refs);
+}
+
+static void virtblk_put(struct virtio_blk *vblk)
+{
+ if (refcount_dec_and_test(>refs)) {
+ ida_simple_remove(_index_ida, vblk->index);
+ mutex_destroy(>vdev_mutex);
+ kfree(vblk);
+ }
+}
+
+static int virtblk_open(struct block_device *bd, fmode_t mode)
+{
+ struct virtio_blk *vblk = bd->bd_disk->private_data;
+ int ret = 0;
+
+ mutex_lock(>vdev_mutex);
+
+ if (vblk->vdev)
+ virtblk_get(vblk);
+ else
+ ret = -ENXIO;
+
+ mutex_unlock(>vdev_mutex);
+ return ret;
+}
+
+static void virtblk_release(struct gendisk *disk, fmode_t mode)
+{
+ struct virtio_blk *vblk = disk->private_data;
+
+ virtblk_put(vblk);
+}
+
/* We provide getgeo only to please some old bootloader/partitioning tools */
static int virtblk_getgeo(struct block_device *bd, struct hd_geometry *geo)
{
struct virtio_blk *vblk = bd->bd_disk->private_data;
+ int ret = 0;
+
+ mutex_lock(>vdev_mutex);
+
+ if (!vblk->vdev) {
+ ret = -ENXIO;
+ goto out;
+ }
/* see if the host passed in geometry config
