pool/drbd
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
44b98926cd
drbd/bsc-1206791-07-drbd-fix-use-after-free-bugs-in-get_initial_state.patch
heming zhao 4e5f7cbf78 Accepting request 1056192 from home:hmzhao:branches:network:ha-clustering:Factory 
- drbd: fix build error against kernel v6.1.1 (bsc#1206791)
  * update bsc-1201335_06-bdi.patch commit log (no code change)
    + bsc-1201335_06-bdi.patch
  * update bsc-1202600_02-dax-introduce-DAX_RECOVERY_WRITE-dax-access-mode.patch (no code change)
    + bsc-1202600_02-dax-introduce-DAX_RECOVERY_WRITE-dax-access-mode.patch
  * using upstream patch to replace exist patch
    - bsc-1204596_02-drbd-stop-using-bdevname-in-drbd_report_io_error.patch
    + bsc-1204596_02-drbd-remove-usage-of-bdevname.patch
  * add new patches
    + bsc-1206791-01-drbd-add-comments-explaining-removal-of-bdi-congesti.patch
    + bsc-1206791-02-drbd-fix-static-analysis-warnings.patch
    + bsc-1206791-03-drbd-fix-warning-about-initializing-multiple-struct-.patch
    + bsc-1206791-04-blk_queue_split__no_present.patch
    + bsc-1206791-05-prandom_u32_max.patch
    + bsc-1206791-06-write_zeroes__no_capable.patch
    + bsc-1206791-07-drbd-fix-use-after-free-bugs-in-get_initial_state.patch
    + bsc-1206791-08-lib-lru_cache-Fixed-array-overflow-caused-by-incorre.patch
    + bsc-1206791-09-pmem-use-fs_dax_get_by_bdev-instead-of-dax_get_by_ho.patch

OBS-URL: https://build.opensuse.org/request/show/1056192
OBS-URL: https://build.opensuse.org/package/show/network:ha-clustering:Factory/drbd?expand=0&rev=142
2023-01-05 13:24:33 +00:00

392 lines
14 KiB
Diff
Raw Blame History

From 2573d91be862ed65781c4a37dcaaa051a905a48a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christoph=20B=C3=B6hmwalder?=
<christoph.boehmwalder@linbit.com>
Date: Wed, 5 Oct 2022 13:36:18 +0200
Subject: [PATCH] drbd: fix use-after-free bugs in get_initial_state
See upstream commit aadb22ba2f65 ("drbd: Fix five use after free bugs
in get_initial_state").
Original message:
In get_initial_state, it calls notify_initial_state_done(skb,..) if
cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(),
the skb will be freed by nlmsg_free(skb).
Then get_initial_state will goto out and the freed skb will be used by
return value skb->len, which is a uaf bug.
What's worse, the same problem goes even further: skb can also be
freed in the notify_*_state_change -> notify_*_state calls below.
Thus 4 additional uaf bugs happened.
My patch lets the problem callee functions: notify_initial_state_done
and notify_*_state_change return an error code if errors happen.
So that the error codes could be propagated and the uaf bugs can be avoid.
---
drbd/drbd_int.h | 10 ++++----
drbd/drbd_nl.c | 51 ++++++++++++++++++++++++----------------
drbd/drbd_state.c | 18 +++++++-------
drbd/drbd_state_change.h | 8 +++----
4 files changed, 49 insertions(+), 38 deletions(-)
diff --git a/drbd/drbd_int.h b/drbd/drbd_int.h
index fcde3b96bd6a..4bf2c6dde93d 100644
--- a/drbd/drbd_int.h
+++ b/drbd/drbd_int.h
@@ -2154,30 +2154,30 @@ extern int drbd_al_initialize(struct drbd_device *, void *);
extern struct mutex notification_mutex;
extern atomic_t drbd_genl_seq;
-extern void notify_resource_state(struct sk_buff *,
+extern int notify_resource_state(struct sk_buff *,
unsigned int,
struct drbd_resource *,
struct resource_info *,
struct rename_resource_info *,
enum drbd_notification_type);
-extern void notify_device_state(struct sk_buff *,
+extern int notify_device_state(struct sk_buff *,
unsigned int,
struct drbd_device *,
struct device_info *,
enum drbd_notification_type);
-extern void notify_connection_state(struct sk_buff *,
+extern int notify_connection_state(struct sk_buff *,
unsigned int,
struct drbd_connection *,
struct connection_info *,
enum drbd_notification_type);
-extern void notify_peer_device_state(struct sk_buff *,
+extern int notify_peer_device_state(struct sk_buff *,
unsigned int,
struct drbd_peer_device *,
struct peer_device_info *,
enum drbd_notification_type);
extern void notify_helper(enum drbd_notification_type, struct drbd_device *,
struct drbd_connection *, const char *, int);
-extern void notify_path(struct drbd_connection *, struct drbd_path *,
+extern int notify_path(struct drbd_connection *, struct drbd_path *,
enum drbd_notification_type);
extern void drbd_broadcast_peer_device_state(struct drbd_peer_device *);
diff --git a/drbd/drbd_nl.c b/drbd/drbd_nl.c
index 3dee5a1ab2eb..4418d143e09f 100644
--- a/drbd/drbd_nl.c
+++ b/drbd/drbd_nl.c
@@ -6492,7 +6492,7 @@ static int nla_put_notification_header(struct sk_buff *msg,
return drbd_notification_header_to_skb(msg, &nh, true);
}
-void notify_resource_state(struct sk_buff *skb,
+int notify_resource_state(struct sk_buff *skb,
unsigned int seq,
struct drbd_resource *resource,
struct resource_info *resource_info,
@@ -6546,16 +6546,17 @@ void notify_resource_state(struct sk_buff *skb,
if (err && err != -ESRCH)
goto failed;
}
- return;
+ return 0;
nla_put_failure:
nlmsg_free(skb);
failed:
drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n",
err, seq);
+ return err;
}
-void notify_device_state(struct sk_buff *skb,
+int notify_device_state(struct sk_buff *skb,
unsigned int seq,
struct drbd_device *device,
struct device_info *device_info,
@@ -6595,17 +6596,18 @@ void notify_device_state(struct sk_buff *skb,
if (err && err != -ESRCH)
goto failed;
}
- return;
+ return 0;
nla_put_failure:
nlmsg_free(skb);
failed:
drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n",
err, seq);
+ return err;
}
/* open coded path_parms_to_skb() iterating of the list */
-void notify_connection_state(struct sk_buff *skb,
+int notify_connection_state(struct sk_buff *skb,
unsigned int seq,
struct drbd_connection *connection,
struct connection_info *connection_info,
@@ -6646,16 +6648,17 @@ void notify_connection_state(struct sk_buff *skb,
if (err && err != -ESRCH)
goto failed;
}
- return;
+ return 0;
nla_put_failure:
nlmsg_free(skb);
failed:
drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n",
err, seq);
+ return err;
}
-void notify_peer_device_state(struct sk_buff *skb,
+int notify_peer_device_state(struct sk_buff *skb,
unsigned int seq,
struct drbd_peer_device *peer_device,
struct peer_device_info *peer_device_info,
@@ -6696,13 +6699,14 @@ void notify_peer_device_state(struct sk_buff *skb,
if (err && err != -ESRCH)
goto failed;
}
- return;
+ return 0;
nla_put_failure:
nlmsg_free(skb);
failed:
drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n",
err, seq);
+ return err;
}
void drbd_broadcast_peer_device_state(struct drbd_peer_device *peer_device)
@@ -6714,7 +6718,7 @@ void drbd_broadcast_peer_device_state(struct drbd_peer_device *peer_device)
mutex_unlock(&notification_mutex);
}
-void notify_path_state(struct sk_buff *skb,
+int notify_path_state(struct sk_buff *skb,
unsigned int seq,
/* until we have a backpointer in drbd_path, we need an explicit connection: */
struct drbd_connection *connection,
@@ -6754,7 +6758,7 @@ void notify_path_state(struct sk_buff *skb,
if (err && err != -ESRCH)
goto failed;
}
- return;
+ return 0;
nla_put_failure:
nlmsg_free(skb);
@@ -6762,16 +6766,19 @@ failed:
/* FIXME add path specifics to our drbd_polymorph_printk.h */
drbd_err(connection, "path: Error %d while broadcasting event. Event seq:%u\n",
err, seq);
+ return err;
}
-void notify_path(struct drbd_connection *connection, struct drbd_path *path, enum drbd_notification_type type)
+int notify_path(struct drbd_connection *connection, struct drbd_path *path, enum drbd_notification_type type)
{
struct drbd_path_info path_info;
+ int err;
path_info.path_established = path->established;
mutex_lock(&notification_mutex);
- notify_path_state(NULL, 0, connection, path, &path_info, type);
+ err = notify_path_state(NULL, 0, connection, path, &path_info, type);
mutex_unlock(&notification_mutex);
+ return err;
}
@@ -6823,7 +6830,7 @@ fail:
err, seq);
}
-static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq)
+static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq)
{
struct drbd_genlmsghdr *dh;
int err;
@@ -6837,11 +6844,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq)
if (nla_put_notification_header(skb, NOTIFY_EXISTS))
goto nla_put_failure;
genlmsg_end(skb, dh);
- return;
+ return 0;
nla_put_failure:
nlmsg_free(skb);
pr_err("Error %d sending event. Event seq:%u\n", err, seq);
+ return err;
}
static void free_state_changes(struct list_head *list)
@@ -6869,6 +6877,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb)
unsigned int seq = cb->args[2];
unsigned int n;
enum drbd_notification_type flags = 0;
+ int err = 0;
/* There is no need for taking notification_mutex here: it doesn't
matter if the initial state events mix with later state change
@@ -6877,20 +6886,20 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb)
cb->args[5]--;
if (cb->args[5] == 1) {
- notify_initial_state_done(skb, seq);
+ err = notify_initial_state_done(skb, seq);
goto out;
}
n = cb->args[4]++;
if (cb->args[4] < cb->args[3])
flags |= NOTIFY_CONTINUES;
if (n < 1) {
- notify_resource_state_change(skb, seq, state_change,
+ err = notify_resource_state_change(skb, seq, state_change,
NOTIFY_EXISTS | flags);
goto next;
}
n--;
if (n < state_change->n_connections) {
- notify_connection_state_change(skb, seq, &state_change->connections[n],
+ err = notify_connection_state_change(skb, seq, &state_change->connections[n],
NOTIFY_EXISTS | flags);
goto next;
}
@@ -6900,7 +6909,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb)
struct drbd_path_info path_info;
path_info.path_established = path_state->path_established;
- notify_path_state(skb, seq,
+ err = notify_path_state(skb, seq,
path_state->connection,
path_state->path,
&path_info, NOTIFY_EXISTS | flags);
@@ -6908,13 +6917,13 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb)
}
n -= state_change->n_paths;
if (n < state_change->n_devices) {
- notify_device_state_change(skb, seq, &state_change->devices[n],
+ err = notify_device_state_change(skb, seq, &state_change->devices[n],
NOTIFY_EXISTS | flags);
goto next;
}
n -= state_change->n_devices;
if (n < state_change->n_devices * state_change->n_connections) {
- notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n],
+ err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n],
NOTIFY_EXISTS | flags);
goto next;
}
@@ -6930,6 +6939,8 @@ next:
cb->args[4] = 0;
}
out:
+ if (err)
+ return err;
return skb->len;
}
diff --git a/drbd/drbd_state.c b/drbd/drbd_state.c
index de53fa7a21f1..cec88b18852f 100644
--- a/drbd/drbd_state.c
+++ b/drbd/drbd_state.c
@@ -3062,7 +3062,7 @@ static union drbd_state state_change_word(struct drbd_state_change *state_change
return state;
}
-void notify_resource_state_change(struct sk_buff *skb,
+int notify_resource_state_change(struct sk_buff *skb,
unsigned int seq,
struct drbd_state_change *state_change,
enum drbd_notification_type type)
@@ -3079,10 +3079,10 @@ void notify_resource_state_change(struct sk_buff *skb,
.res_susp_quorum = state_change_is_susp_quorum(state_change, NEW),
};
- notify_resource_state(skb, seq, resource, &resource_info, NULL, type);
+ return notify_resource_state(skb, seq, resource, &resource_info, NULL, type);
}
-void notify_connection_state_change(struct sk_buff *skb,
+int notify_connection_state_change(struct sk_buff *skb,
unsigned int seq,
struct drbd_connection_state_change *connection_state_change,
enum drbd_notification_type type)
@@ -3093,10 +3093,10 @@ void notify_connection_state_change(struct sk_buff *skb,
.conn_role = connection_state_change->peer_role[NEW],
};
- notify_connection_state(skb, seq, connection, &connection_info, type);
+ return notify_connection_state(skb, seq, connection, &connection_info, type);
}
-void notify_device_state_change(struct sk_buff *skb,
+int notify_device_state_change(struct sk_buff *skb,
unsigned int seq,
struct drbd_device_state_change *device_state_change,
enum drbd_notification_type type)
@@ -3105,10 +3105,10 @@ void notify_device_state_change(struct sk_buff *skb,
struct device_info device_info;
device_state_change_to_info(&device_info, device_state_change);
- notify_device_state(skb, seq, device, &device_info, type);
+ return notify_device_state(skb, seq, device, &device_info, type);
}
-void notify_peer_device_state_change(struct sk_buff *skb,
+int notify_peer_device_state_change(struct sk_buff *skb,
unsigned int seq,
struct drbd_peer_device_state_change *state_change,
enum drbd_notification_type type)
@@ -3117,7 +3117,7 @@ void notify_peer_device_state_change(struct sk_buff *skb,
struct peer_device_info peer_device_info;
peer_device_state_change_to_info(&peer_device_info, state_change);
- notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type);
+ return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type);
}
static void notify_state_change(struct drbd_state_change *state_change)
@@ -3125,7 +3125,7 @@ static void notify_state_change(struct drbd_state_change *state_change)
struct drbd_resource_state_change *resource_state_change = &state_change->resource[0];
bool resource_state_has_changed;
unsigned int n_device, n_connection, n_peer_device, n_peer_devices;
- void (*last_func)(struct sk_buff *, unsigned int, void *,
+ int (*last_func)(struct sk_buff *, unsigned int, void *,
enum drbd_notification_type) = NULL;
void *last_arg = NULL;
diff --git a/drbd/drbd_state_change.h b/drbd/drbd_state_change.h
index e60ec1b8ee6e..df23977462c1 100644
--- a/drbd/drbd_state_change.h
+++ b/drbd/drbd_state_change.h
@@ -66,19 +66,19 @@ extern struct drbd_state_change *remember_state_change(struct drbd_resource *, g
extern void copy_old_to_new_state_change(struct drbd_state_change *);
extern void forget_state_change(struct drbd_state_change *);
-extern void notify_resource_state_change(struct sk_buff *,
+extern int notify_resource_state_change(struct sk_buff *,
unsigned int,
struct drbd_state_change *,
enum drbd_notification_type type);
-extern void notify_connection_state_change(struct sk_buff *,
+extern int notify_connection_state_change(struct sk_buff *,
unsigned int,
struct drbd_connection_state_change *,
enum drbd_notification_type type);
-extern void notify_device_state_change(struct sk_buff *,
+extern int notify_device_state_change(struct sk_buff *,
unsigned int,
struct drbd_device_state_change *,
enum drbd_notification_type type);
-extern void notify_peer_device_state_change(struct sk_buff *,
+extern int notify_peer_device_state_change(struct sk_buff *,
unsigned int,
struct drbd_peer_device_state_change *,
enum drbd_notification_type type);
--
2.26.2
Reference in New Issue View Git Blame Copy Permalink