Commit 25966fc0 authored by Mehul Rao's avatar Mehul Rao Committed by Jens Axboe
Browse files

ublk: fix NULL pointer dereference in ublk_ctrl_set_size() 



ublk_ctrl_set_size() unconditionally dereferences ub->ub_disk via
set_capacity_and_notify() without checking if it is NULL.

ub->ub_disk is NULL before UBLK_CMD_START_DEV completes (it is only
assigned in ublk_ctrl_start_dev()) and after UBLK_CMD_STOP_DEV runs
(ublk_detach_disk() sets it to NULL). Since the UBLK_CMD_UPDATE_SIZE
handler performs no state validation, a user can trigger a NULL pointer
dereference by sending UPDATE_SIZE to a device that has been added but
not yet started, or one that has been stopped.

Fix this by checking ub->ub_disk under ub->mutex before dereferencing
it, and returning -ENODEV if the disk is not available.

Fixes: 98b99566 ("ublk: Add UBLK_U_CMD_UPDATE_SIZE")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarMehul Rao <mehulrao@gmail.com>
Reviewed-by: default avatarMing Lei <ming.lei@redhat.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent ce8ee858

drivers/block/ublk_drv.c

+9 −3
Original line number Diff line number Diff line
@@ -5003,15 +5003,22 @@ static int ublk_ctrl_get_features(const struct ublksrv_ctrl_cmd *header) 
	return 0;

}



static void ublk_ctrl_set_size(struct ublk_device *ub, const struct ublksrv_ctrl_cmd *header)

static int ublk_ctrl_set_size(struct ublk_device *ub, const struct ublksrv_ctrl_cmd *header)

{

	struct ublk_param_basic *p = &ub->params.basic;

	u64 new_size = header->data[0];

	int ret = 0;



	mutex_lock(&ub->mutex);

	if (!ub->ub_disk) {

		ret = -ENODEV;

		goto out;

	}

	p->dev_sectors = new_size;

	set_capacity_and_notify(ub->ub_disk, p->dev_sectors);

out:

	mutex_unlock(&ub->mutex);

	return ret;

}



struct count_busy {
@@ -5331,8 +5338,7 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd, 
		ret = ublk_ctrl_end_recovery(ub, &header);

		break;

	case UBLK_CMD_UPDATE_SIZE:

		ublk_ctrl_set_size(ub, &header);

		ret = 0;

		ret = ublk_ctrl_set_size(ub, &header);

		break;

	case UBLK_CMD_QUIESCE_DEV:

		ret = ublk_ctrl_quiesce_dev(ub, &header);