Edwin Török 55acdd926f dlm: avoid double-free on error path in dlm_device_{register,unregister} ... Can be reproduced when running dlm_controld (tested on 4.4.x, 4.12.4): # seq 1 100 | xargs -P0 -n1 dlm_tool join # seq 1 100 | xargs -P0 -n1 dlm_tool leave misc_register fails due to duplicate sysfs entry, which causes dlm_device_register to free ls->ls_device.name. In dlm_device_deregister the name was freed again, causing memory corruption. According to the comment in dlm_device_deregister the name should've been set to NULL when registration fails, so this patch does that. sysfs: cannot create duplicate filename '/dev/char/10:1' ------------[ cut here ]------------ warning: cpu: 1 pid: 4450 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x56/0x70 modules linked in: msr rfcomm dlm ccm bnep dm_crypt uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core videodev btusb media btrtl btbcm btintel bluetooth ecdh_generic intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm snd_hda_codec_hdmi irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel thinkpad_acpi pcbc nvram snd_seq_midi snd_seq_midi_event aesni_intel snd_hda_codec_realtek snd_hda_codec_generic snd_rawmidi aes_x86_64 crypto_simd glue_helper snd_hda_intel snd_hda_codec cryptd intel_cstate arc4 snd_hda_core snd_seq snd_seq_device snd_hwdep iwldvm intel_rapl_perf mac80211 joydev input_leds iwlwifi serio_raw cfg80211 snd_pcm shpchp snd_timer snd mac_hid mei_me lpc_ich mei soundcore sunrpc parport_pc ppdev lp parport autofs4 i915 psmouse e1000e ahci libahci i2c_algo_bit sdhci_pci ptp drm_kms_helper sdhci pps_core syscopyarea sysfillrect sysimgblt fb_sys_fops drm wmi video cpu: 1 pid: 4450 comm: dlm_test.exe not tainted 4.12.4-041204-generic hardware name: lenovo 232425u/232425u, bios g2et82ww (2.02 ) 09/11/2012 task: ffff96b0cbabe140 task.stack: ffffb199027d0000 rip: 0010:sysfs_warn_dup+0x56/0x70 rsp: 0018:ffffb199027d3c58 eflags: 00010282 rax: 0000000000000038 rbx: ffff96b0e2c49158 rcx: 0000000000000006 rdx: 0000000000000000 rsi: 0000000000000086 rdi: ffff96b15e24dcc0 rbp: ffffb199027d3c70 r08: 0000000000000001 r09: 0000000000000721 r10: ffffb199027d3c00 r11: 0000000000000721 r12: ffffb199027d3cd1 r13: ffff96b1592088f0 r14: 0000000000000001 r15: ffffffffffffffef fs: 00007f78069c0700(0000) gs:ffff96b15e240000(0000) knlgs:0000000000000000 cs: 0010 ds: 0000 es: 0000 cr0: 0000000080050033 cr2: 000000178625ed28 cr3: 0000000091d3e000 cr4: 00000000001406e0 call trace: sysfs_do_create_link_sd.isra.2+0x9e/0xb0 sysfs_create_link+0x25/0x40 device_add+0x5a9/0x640 device_create_groups_vargs+0xe0/0xf0 device_create_with_groups+0x3f/0x60 ? snprintf+0x45/0x70 misc_register+0x140/0x180 device_write+0x6a8/0x790 [dlm] __vfs_write+0x37/0x160 ? apparmor_file_permission+0x1a/0x20 ? security_file_permission+0x3b/0xc0 vfs_write+0xb5/0x1a0 sys_write+0x55/0xc0 ? sys_fcntl+0x5d/0xb0 entry_syscall_64_fastpath+0x1e/0xa9 rip: 0033:0x7f78083454bd rsp: 002b:00007f78069bbd30 eflags: 00000293 orig_rax: 0000000000000001 rax: ffffffffffffffda rbx: 0000000000000006 rcx: 00007f78083454bd rdx: 000000000000009c rsi: 00007f78069bee00 rdi: 0000000000000005 rbp: 00007f77f8000a20 r08: 000000000000fcf0 r09: 0000000000000032 r10: 0000000000000024 r11: 0000000000000293 r12: 00007f78069bde00 r13: 00007f78069bee00 r14: 000000000000000a r15: 00007f78069bbd70 code: 85 c0 48 89 c3 74 12 b9 00 10 00 00 48 89 c2 31 f6 4c 89 ef e8 2c c8 ff ff 4c 89 e2 48 89 de 48 c7 c7 b0 8e 0c a8 e8 41 e8 ed ff <0f> ff 48 89 df e8 00 d5 f4 ff 5b 41 5c 41 5d 5d c3 66 0f 1f 84 ---[ end trace 40412246357cc9e0 ]--- dlm: 59f24629-ae39-44e2-9030-397ebc2eda26: leaving the lockspace group... bug: unable to handle kernel null pointer dereference at 0000000000000001 ip: [<ffffffff811a3b4a>] kmem_cache_alloc+0x7a/0x140 pgd 0 oops: 0000 [#1] smp modules linked in: dlm 8021q garp mrp stp llc openvswitch nf_defrag_ipv6 nf_conntrack libcrc32c iptable_filter dm_multipath crc32_pclmul dm_mod aesni_intel psmouse aes_x86_64 sg ablk_helper cryptd lrw gf128mul glue_helper i2c_piix4 nls_utf8 tpm_tis tpm isofs nfsd auth_rpcgss oid_registry nfs_acl lockd grace sunrpc xen_wdt ip_tables x_tables autofs4 hid_generic usbhid hid sr_mod cdrom sd_mod ata_generic pata_acpi 8139too serio_raw ata_piix 8139cp mii uhci_hcd ehci_pci ehci_hcd libata scsi_dh_rdac scsi_dh_hp_sw scsi_dh_emc scsi_dh_alua scsi_mod ipv6 cpu: 0 pid: 394 comm: systemd-udevd tainted: g w 4.4.0+0 #1 hardware name: xen hvm domu, bios 4.7.2-2.2 05/11/2017 task: ffff880002410000 ti: ffff88000243c000 task.ti: ffff88000243c000 rip: e030:[<ffffffff811a3b4a>] [<ffffffff811a3b4a>] kmem_cache_alloc+0x7a/0x140 rsp: e02b:ffff88000243fd90 eflags: 00010202 rax: 0000000000000000 rbx: ffff8800029864d0 rcx: 000000000007b36c rdx: 000000000007b36b rsi: 00000000024000c0 rdi: ffff880036801c00 rbp: ffff88000243fdc0 r08: 0000000000018880 r09: 0000000000000054 r10: 000000000000004a r11: ffff880034ace6c0 r12: 00000000024000c0 r13: ffff880036801c00 r14: 0000000000000001 r15: ffffffff8118dcc2 fs: 00007f0ab77548c0(0000) gs:ffff880036e00000(0000) knlgs:0000000000000000 cs: e033 ds: 0000 es: 0000 cr0: 0000000080050033 cr2: 0000000000000001 cr3: 000000000332d000 cr4: 0000000000040660 stack: ffffffff8118dc90 ffff8800029864d0 0000000000000000 ffff88003430b0b0 ffff880034b78320 ffff88003430b0b0 ffff88000243fdf8 ffffffff8118dcc2 ffff8800349c6700 ffff8800029864d0 000000000000000b 00007f0ab7754b90 call trace: [<ffffffff8118dc90>] ? anon_vma_fork+0x60/0x140 [<ffffffff8118dcc2>] anon_vma_fork+0x92/0x140 [<ffffffff8107033e>] copy_process+0xcae/0x1a80 [<ffffffff8107128b>] _do_fork+0x8b/0x2d0 [<ffffffff81071579>] sys_clone+0x19/0x20 [<ffffffff815a30ae>] entry_syscall_64_fastpath+0x12/0x71 ] code: f6 75 1c 4c 89 fa 44 89 e6 4c 89 ef e8 a7 e4 00 00 41 f7 c4 00 80 00 00 49 89 c6 74 47 eb 32 49 63 45 20 48 8d 4a 01 4d 8b 45 00 <49> 8b 1c 06 4c 89 f0 65 49 0f c7 08 0f 94 c0 84 c0 74 ac 49 63 rip [<ffffffff811a3b4a>] kmem_cache_alloc+0x7a/0x140 rsp <ffff88000243fd90> cr2: 0000000000000001 --[ end trace 70cb9fd1b164a0e8 ]-- CC: stable@vger.kernel.org Signed-off-by: Edwin Török <edvin.torok@citrix.com> Signed-off-by: David Teigland <teigland@redhat.com>		2017-08-07 11:23:09 -05:00
..
ast.c	dlm: don't specify WQ_UNBOUND for the ast callback workqueue	2016-10-19 11:13:04 -05:00
ast.h	dlm: use workqueue for callbacks	2011-07-15 12:30:43 -05:00
config.c	dlm: audit and remove any unnecessary uses of module.h	2016-10-19 11:00:03 -05:00
config.h	dlm: add log_info config option	2016-06-21 09:04:24 -05:00
debug_fs.c	dlm: Improve a size determination in table_seq_start()	2017-08-07 11:23:09 -05:00
dir.c	dlm: use INFO for recovery messages	2014-02-14 11:54:44 -06:00
dir.h	dlm: use rsbtbl as resource directory	2012-07-16 14:16:19 -05:00
dlm_internal.h	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
Kconfig	fs/dlm: remove CONFIG_EXPERIMENTAL	2012-11-01 15:27:24 -05:00
lock.c	dlm: Delete an error message for a failed memory allocation in dlm_recover_waiters_pre()	2017-08-07 11:23:09 -05:00
lock.h	dlm: adopt orphan locks	2014-11-19 14:48:02 -06:00
lockspace.c	dlm: constify kset_uevent_ops structure	2017-08-07 11:23:09 -05:00
lockspace.h	dlm: detect available userspace daemon	2008-08-28 11:49:43 -05:00
lowcomms.c	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
lowcomms.h	dlm: fix deadlock between dlm_send and dlm_controld	2012-08-08 11:33:35 -05:00
lvb_table.h	[DLM] The core of the DLM for GFS2/CLVM	2006-01-18 09:30:29 +00:00
main.c	dlm: audit and remove any unnecessary uses of module.h	2016-10-19 11:00:03 -05:00
Makefile	dlm: move plock code from gfs2	2008-04-21 11:22:28 -05:00
member.c	dlm: Delete an unnecessary variable initialisation in dlm_ls_start()	2017-08-07 11:23:09 -05:00
member.h	dlm: add recovery callbacks	2012-01-04 08:56:31 -06:00
memory.c	dlm: NULL dereference on failure in kmem_cache_create()	2012-05-15 10:39:28 -05:00
memory.h	dlm: improve rsb searches	2011-07-12 16:02:09 -05:00
midcomms.c	dlm: fix up memory allocation flags	2008-12-23 10:15:40 -06:00
midcomms.h	[DLM] The core of the DLM for GFS2/CLVM	2006-01-18 09:30:29 +00:00
netlink.c	dlm for 4.10	2016-12-14 08:31:37 -08:00
plock.c	dlm for 4.4	2015-11-05 11:15:25 -08:00
rcom.c	dlm: fix missing endian conversion of rcom_status flags	2014-10-14 15:11:48 -05:00
rcom.h	dlm: use rsbtbl as resource directory	2012-07-16 14:16:19 -05:00
recover.c	dlm: use INFO for recovery messages	2014-02-14 11:54:44 -06:00
recover.h	dlm: use rsbtbl as resource directory	2012-07-16 14:16:19 -05:00
recoverd.c	dlm: use INFO for recovery messages	2014-02-14 11:54:44 -06:00
recoverd.h	dlm: fix unlock balance warnings	2012-08-08 11:33:49 -05:00
requestqueue.c	dlm: fixes for nodir mode	2012-05-02 14:15:27 -05:00
requestqueue.h	dlm: use proper C for dlm/requestqueue stuff (and fix alignment bug)	2008-02-04 01:21:32 -06:00
user.c	dlm: avoid double-free on error path in dlm_device_{register,unregister}	2017-08-07 11:23:09 -05:00
user.h	dlm: record full callback state	2011-03-10 10:40:00 -06:00
util.c	dlm: do not byteswap rcom_config	2008-02-04 01:23:43 -06:00
util.h	[DLM] The core of the DLM for GFS2/CLVM	2006-01-18 09:30:29 +00:00