Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

dm: fix dm_blk_report_zones

If dm_get_live_table() returned NULL, dm_put_live_table() was never
called. Also, it is possible that md->zone_revalidate_map will change
while calling this function. Only read it once, so that we are always
using the same value. Otherwise we might miss a call to
dm_put_live_table().

Finally, while md->zone_revalidate_map is set and a process is calling
blk_revalidate_disk_zones() to set up the zone append emulation
resources, it is possible that another process, perhaps triggered by
blkdev_report_zones_ioctl(), will call dm_blk_report_zones(). If
blk_revalidate_disk_zones() fails, these resources can be freed while
the other process is still using them, causing a use-after-free error.

blk_revalidate_disk_zones() will only ever be called when initially
setting up the zone append emulation resources, such as when setting up
a zoned dm-crypt table for the first time. Further table swaps will not
set md->zone_revalidate_map or call blk_revalidate_disk_zones().
However it must be called using the new table (referenced by
md->zone_revalidate_map) and the new queue limits while the DM device is
suspended. dm_blk_report_zones() needs some way to distinguish between a
call from blk_revalidate_disk_zones(), which must be allowed to use
md->zone_revalidate_map to access this not yet activated table, and all
other calls to dm_blk_report_zones(), which should not be allowed while
the device is suspended and cannot use md->zone_revalidate_map, since
the zone resources might be freed by the process currently calling
blk_revalidate_disk_zones().

Solve this by tracking the process that sets md->zone_revalidate_map in
dm_revalidate_zones() and only allowing that process to make use of it
in dm_blk_report_zones().

Fixes: f211268ed1f9b ("dm: Use the block layer zone append emulation")
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Tested-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

authored by

Benjamin Marzinski and committed by
Mikulas Patocka
37f53a2c 4ea30ec6

+18 -8
+1
drivers/md/dm-core.h
··· 141 141 #ifdef CONFIG_BLK_DEV_ZONED 142 142 unsigned int nr_zones; 143 143 void *zone_revalidate_map; 144 + struct task_struct *revalidate_map_task; 144 145 #endif 145 146 146 147 #ifdef CONFIG_IMA
+17 -8
drivers/md/dm-zone.c
··· 56 56 { 57 57 struct mapped_device *md = disk->private_data; 58 58 struct dm_table *map; 59 - int srcu_idx, ret; 59 + struct dm_table *zone_revalidate_map = md->zone_revalidate_map; 60 + int srcu_idx, ret = -EIO; 61 + bool put_table = false; 60 62 61 - if (!md->zone_revalidate_map) { 62 - /* Regular user context */ 63 + if (!zone_revalidate_map || md->revalidate_map_task != current) { 64 + /* 65 + * Regular user context or 66 + * Zone revalidation during __bind() is in progress, but this 67 + * call is from a different process 68 + */ 63 69 if (dm_suspended_md(md)) 64 70 return -EAGAIN; 65 71 66 72 map = dm_get_live_table(md, &srcu_idx); 67 - if (!map) 68 - return -EIO; 73 + put_table = true; 69 74 } else { 70 75 /* Zone revalidation during __bind() */ 71 - map = md->zone_revalidate_map; 76 + map = zone_revalidate_map; 72 77 } 73 78 74 - ret = dm_blk_do_report_zones(md, map, sector, nr_zones, cb, data); 79 + if (map) 80 + ret = dm_blk_do_report_zones(md, map, sector, nr_zones, cb, 81 + data); 75 82 76 - if (!md->zone_revalidate_map) 83 + if (put_table) 77 84 dm_put_live_table(md, srcu_idx); 78 85 79 86 return ret; ··· 182 175 * our table for dm_blk_report_zones() to use directly. 183 176 */ 184 177 md->zone_revalidate_map = t; 178 + md->revalidate_map_task = current; 185 179 ret = blk_revalidate_disk_zones(disk); 180 + md->revalidate_map_task = NULL; 186 181 md->zone_revalidate_map = NULL; 187 182 188 183 if (ret) {