Commit 32746272 authored by Li Lingfeng's avatar Li Lingfeng Committed by Jens Axboe
Browse files

nbd: fix uaf in nbd_open 



Commit 4af5f2e0 ("nbd: use blk_mq_alloc_disk and
blk_cleanup_disk") cleans up disk by blk_cleanup_disk() and it won't set
disk->private_data as NULL as before. UAF may be triggered in nbd_open()
if someone tries to open nbd device right after nbd_put() since nbd has
been free in nbd_dev_remove().

Fix this by implementing ->free_disk and free private data in it.

Fixes: 4af5f2e0 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk")
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
Reviewed-by: default avatarJosef Bacik <josef@toxicpanda.com>
Link: https://lore.kernel.org/r/20231107103435.2074904-1-lilingfeng@huaweicloud.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent d2f51b35

drivers/block/nbd.c

+9 −2
Original line number Diff line number Diff line
@@ -250,7 +250,6 @@ static void nbd_dev_remove(struct nbd_device *nbd) 
	struct gendisk *disk = nbd->disk;



	del_gendisk(disk);

	put_disk(disk);

	blk_mq_free_tag_set(&nbd->tag_set);



	/*
@@ -261,7 +260,7 @@ static void nbd_dev_remove(struct nbd_device *nbd) 
	idr_remove(&nbd_index_idr, nbd->index);

	mutex_unlock(&nbd_index_mutex);

	destroy_workqueue(nbd->recv_workq);

	kfree(nbd);

	put_disk(disk);

}



static void nbd_dev_remove_work(struct work_struct *work)
@@ -1608,6 +1607,13 @@ static void nbd_release(struct gendisk *disk) 
	nbd_put(nbd);

}



static void nbd_free_disk(struct gendisk *disk)

{

	struct nbd_device *nbd = disk->private_data;



	kfree(nbd);

}



static const struct block_device_operations nbd_fops =

{

	.owner =	THIS_MODULE,
@@ -1615,6 +1621,7 @@ static const struct block_device_operations nbd_fops = 
	.release =	nbd_release,

	.ioctl =	nbd_ioctl,

	.compat_ioctl =	nbd_ioctl,

	.free_disk =	nbd_free_disk,

};



#if IS_ENABLED(CONFIG_DEBUG_FS)