Commit 37f53a2c authored by Benjamin Marzinski's avatar Benjamin Marzinski Committed by Mikulas Patocka
Browse files

dm: fix dm_blk_report_zones 



If dm_get_live_table() returned NULL, dm_put_live_table() was never
called. Also, it is possible that md->zone_revalidate_map will change
while calling this function. Only read it once, so that we are always
using the same value. Otherwise we might miss a call to
dm_put_live_table().

Finally, while md->zone_revalidate_map is set and a process is calling
blk_revalidate_disk_zones() to set up the zone append emulation
resources, it is possible that another process, perhaps triggered by
blkdev_report_zones_ioctl(), will call dm_blk_report_zones(). If
blk_revalidate_disk_zones() fails, these resources can be freed while
the other process is still using them, causing a use-after-free error.

blk_revalidate_disk_zones() will only ever be called when initially
setting up the zone append emulation resources, such as when setting up
a zoned dm-crypt table for the first time. Further table swaps will not
set md->zone_revalidate_map or call blk_revalidate_disk_zones().
However it must be called using the new table (referenced by
md->zone_revalidate_map) and the new queue limits while the DM device is
suspended. dm_blk_report_zones() needs some way to distinguish between a
call from blk_revalidate_disk_zones(), which must be allowed to use
md->zone_revalidate_map to access this not yet activated table, and all
other calls to dm_blk_report_zones(), which should not be allowed while
the device is suspended and cannot use md->zone_revalidate_map, since
the zone resources might be freed by the process currently calling
blk_revalidate_disk_zones().

Solve this by tracking the process that sets md->zone_revalidate_map in
dm_revalidate_zones() and only allowing that process to make use of it
in dm_blk_report_zones().

Fixes: f211268e ("dm: Use the block layer zone append emulation")
Reviewed-by: default avatarDamien Le Moal <dlemoal@kernel.org>
Tested-by: default avatarDamien Le Moal <dlemoal@kernel.org>
Signed-off-by: default avatarBenjamin Marzinski <bmarzins@redhat.com>
Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
parent 4ea30ec6

drivers/md/dm-core.h

+1 −0
Original line number Diff line number Diff line
@@ -141,6 +141,7 @@ struct mapped_device { 
#ifdef CONFIG_BLK_DEV_ZONED

	unsigned int nr_zones;

	void *zone_revalidate_map;

	struct task_struct *revalidate_map_task;

#endif



#ifdef CONFIG_IMA

drivers/md/dm-zone.c

+17 −8
Original line number Diff line number Diff line
@@ -56,24 +56,31 @@ int dm_blk_report_zones(struct gendisk *disk, sector_t sector, 
{

	struct mapped_device *md = disk->private_data;

	struct dm_table *map;

	int srcu_idx, ret;

	struct dm_table *zone_revalidate_map = md->zone_revalidate_map;

	int srcu_idx, ret = -EIO;

	bool put_table = false;



	if (!md->zone_revalidate_map) {

		/* Regular user context */

	if (!zone_revalidate_map || md->revalidate_map_task != current) {

		/*

		 * Regular user context or

		 * Zone revalidation during __bind() is in progress, but this

		 * call is from a different process

		 */

		if (dm_suspended_md(md))

			return -EAGAIN;



		map = dm_get_live_table(md, &srcu_idx);

		if (!map)

			return -EIO;

		put_table = true;

	} else {

		/* Zone revalidation during __bind() */

		map = md->zone_revalidate_map;

		map = zone_revalidate_map;

	}



	ret = dm_blk_do_report_zones(md, map, sector, nr_zones, cb, data);

	if (map)

		ret = dm_blk_do_report_zones(md, map, sector, nr_zones, cb,

					     data);



	if (!md->zone_revalidate_map)

	if (put_table)

		dm_put_live_table(md, srcu_idx);



	return ret;
@@ -175,7 +182,9 @@ int dm_revalidate_zones(struct dm_table *t, struct request_queue *q) 
	 * our table for dm_blk_report_zones() to use directly.

	 */

	md->zone_revalidate_map = t;

	md->revalidate_map_task = current;

	ret = blk_revalidate_disk_zones(disk);

	md->revalidate_map_task = NULL;

	md->zone_revalidate_map = NULL;



	if (ret) {