Coly Li 5bebf7486d bcache: fix memory corruption in bch_cache_accounting_clear() ... Commit 83ff9318c4 ("bcache: not use hard coded memset size in bch_cache_accounting_clear()") tries to make the code more easy to understand by removing the hard coded number with following change, void bch_cache_accounting_clear(...) { memset(&acc->total.cache_hits, 0, - sizeof(unsigned long) * 7); + sizeof(struct cache_stats)); } Unfortunately the change was wrong (it also tells us the original code was not easy to correctly understand). The hard coded number 7 is used because in struct cache_stats, 15 struct cache_stats { 16 struct kobject kobj; 17 18 unsigned long cache_hits; 19 unsigned long cache_misses; 20 unsigned long cache_bypass_hits; 21 unsigned long cache_bypass_misses; 22 unsigned long cache_readaheads; 23 unsigned long cache_miss_collisions; 24 unsigned long sectors_bypassed; 25 26 unsigned int rescale; 27 }; only members in LINE 18-24 want to be set to 0. It is wrong to use 'sizeof(struct cache_stats)' to replace 'sizeof(unsigned long) * 7), the memory objects behind acc->total is staled by this change. Сорокин Артем Сергеевич reports that by the following steps, kernel panic will be triggered, 1. Create new set: make-bcache -B /dev/nvme1n1 -C /dev/sda --wipe-bcache 2. Run in /sys/fs/bcache/<uuid>: echo 1 > clear_stats && cat stats_five_minute/cache_bypass_hits I can reproduce the panic and get following dmesg with KASAN enabled, [22613.172742] ================================================================== [22613.172862] BUG: KASAN: null-ptr-deref in sysfs_kf_seq_show+0x117/0x230 [22613.172864] Read of size 8 at addr 0000000000000000 by task cat/6753 [22613.172870] CPU: 1 PID: 6753 Comm: cat Not tainted 5.5.0-rc7-lp151.28.16-default+ #11 [22613.172872] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019 [22613.172873] Call Trace: [22613.172964] dump_stack+0x8b/0xbb [22613.172968] ? sysfs_kf_seq_show+0x117/0x230 [22613.172970] ? sysfs_kf_seq_show+0x117/0x230 [22613.173031] __kasan_report+0x176/0x192 [22613.173064] ? pr_cont_kernfs_name+0x40/0x60 [22613.173067] ? sysfs_kf_seq_show+0x117/0x230 [22613.173070] kasan_report+0xe/0x20 [22613.173072] sysfs_kf_seq_show+0x117/0x230 [22613.173105] seq_read+0x199/0x6d0 [22613.173110] vfs_read+0xa5/0x1a0 [22613.173113] ksys_read+0x110/0x160 [22613.173115] ? kernel_write+0xb0/0xb0 [22613.173177] do_syscall_64+0x77/0x290 [22613.173238] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [22613.173241] RIP: 0033:0x7fc2c886ac61 [22613.173244] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89 [22613.173245] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [22613.173248] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61 [22613.173249] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003 [22613.173250] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000 [22613.173251] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000 [22613.173253] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000 [22613.173255] ================================================================== [22613.173256] Disabling lock debugging due to kernel taint [22613.173350] BUG: kernel NULL pointer dereference, address: 0000000000000000 [22613.178380] #PF: supervisor read access in kernel mode [22613.180959] #PF: error_code(0x0000) - not-present page [22613.183444] PGD 0 P4D 0 [22613.184867] Oops: 0000 [#1] SMP KASAN PTI [22613.186797] CPU: 1 PID: 6753 Comm: cat Tainted: G B 5.5.0-rc7-lp151.28.16-default+ #11 [22613.191253] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019 [22613.196706] RIP: 0010:sysfs_kf_seq_show+0x117/0x230 [22613.199097] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48 [22613.208016] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246 [22613.210448] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6 [22613.213691] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246 [22613.216893] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd [22613.220075] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200 [22613.223256] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000 [22613.226290] FS: 00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000 [22613.229637] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [22613.231993] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0 [22613.234909] Call Trace: [22613.235931] seq_read+0x199/0x6d0 [22613.237259] vfs_read+0xa5/0x1a0 [22613.239229] ksys_read+0x110/0x160 [22613.240590] ? kernel_write+0xb0/0xb0 [22613.242040] do_syscall_64+0x77/0x290 [22613.243625] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [22613.245450] RIP: 0033:0x7fc2c886ac61 [22613.246706] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89 [22613.253296] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [22613.255835] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61 [22613.258472] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003 [22613.260807] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000 [22613.263188] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000 [22613.265598] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000 [22613.268729] Modules linked in: scsi_transport_iscsi af_packet iscsi_ibft iscsi_boot_sysfs vmw_vsock_vmci_transport vsock fuse bnep kvm_intel kvm irqbypass crc32_pclmul crc32c_intel ghash_clmulni_intel snd_ens1371 snd_ac97_codec ac97_bus bcache snd_pcm btusb btrtl btbcm btintel crc64 aesni_intel glue_helper crypto_simd vmw_balloon cryptd bluetooth snd_timer snd_rawmidi snd joydev pcspkr e1000 rfkill vmw_vmci soundcore ecdh_generic ecc gameport i2c_piix4 mptctl ac button hid_generic usbhid sr_mod cdrom ata_generic ehci_pci vmwgfx uhci_hcd drm_kms_helper syscopyarea serio_raw sysfillrect sysimgblt fb_sys_fops ttm ehci_hcd mptspi scsi_transport_spi mptscsih ata_piix mptbase ahci usbcore libahci drm sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua [22613.292429] CR2: 0000000000000000 [22613.293563] ---[ end trace a074b26a8508f378 ]--- [22613.295138] RIP: 0010:sysfs_kf_seq_show+0x117/0x230 [22613.296769] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48 [22613.303553] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246 [22613.305280] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6 [22613.307924] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246 [22613.310272] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd [22613.312685] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200 [22613.315076] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000 [22613.318116] FS: 00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000 [22613.320743] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [22613.322628] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0 Here this patch fixes the following problem by explicity set all the 7 members to 0 in bch_cache_accounting_clear(). Reported-by: Сорокин Артем Сергеевич <a.sorokin@bank-hlynov.ru> Signed-off-by: Coly Li <colyli@suse.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>		2020-02-01 07:55:39 -07:00
..
bcache	bcache: fix memory corruption in bch_cache_accounting_clear()	2020-02-01 07:55:39 -07:00
persistent-data	dm btree: increase rebalance threshold in __rebalance2()	2019-12-05 15:27:52 -05:00
dm-bio-prison-v1.c	dm bio prison: replace spin_lock_irqsave with spin_lock_irq	2019-11-05 14:53:03 -05:00
dm-bio-prison-v1.h
dm-bio-prison-v2.c	dm bio prison: replace spin_lock_irqsave with spin_lock_irq	2019-11-05 14:53:03 -05:00
dm-bio-prison-v2.h
dm-bio-record.h	block: replace bi_bdev with a gendisk pointer and partitions index	2017-08-23 12:49:55 -06:00
dm-bufio.c	dm bufio: introduce a global cache replacement	2019-09-13 17:00:21 -04:00
dm-builtin.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
dm-cache-background-tracker.c	dm cache background tracker: fix sparse warning	2018-04-30 15:40:40 -04:00
dm-cache-background-tracker.h
dm-cache-block-types.h
dm-cache-metadata.c	dm cache metadata: Fix loading discard bitset	2019-04-18 16:18:25 -04:00
dm-cache-metadata.h
dm-cache-policy-internal.h
dm-cache-policy-smq.c	dm: remove unnecessary unlikely() around WARN_ON_ONCE()	2018-10-16 14:34:59 -04:00
dm-cache-policy.c
dm-cache-policy.h
dm-cache-target.c	dm cache: replace spin_lock_irqsave with spin_lock_irq	2019-11-05 14:53:04 -05:00
dm-clone-metadata.c	dm clone metadata: Use a two phase commit	2019-12-05 15:27:54 -05:00
dm-clone-metadata.h	dm clone metadata: Use a two phase commit	2019-12-05 15:27:54 -05:00
dm-clone-target.c	dm clone: Flush destination device before committing metadata	2019-12-05 17:05:23 -05:00
dm-core.h	dm: disable DISCARD if the underlying storage no longer supports it	2019-04-04 15:33:59 -04:00
dm-crypt.c	Revert "dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues"	2019-11-20 17:27:39 -05:00
dm-delay.c	dm delay: fix a crash when invalid device is specified	2019-04-26 11:29:32 -04:00
dm-dust.c	dm dust: add limited write failure mode	2019-11-05 15:25:34 -05:00
dm-era-target.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
dm-exception-store.c
dm-exception-store.h	- Improve DM snapshot target's scalability by using finer grained	2019-05-16 15:55:48 -07:00
dm-flakey.c	block: rework zone reporting	2019-11-12 19:12:07 -07:00
dm-init.c	docs: device-mapper: move it to the admin-guide	2019-07-15 11:03:01 -03:00
dm-integrity.c	dm integrity: fix excessive alignment of metadata runs	2019-11-15 14:49:16 -05:00
dm-io.c	dm: Use kzalloc for all structs with embedded biosets/mempools	2018-06-05 08:47:43 -06:00
dm-ioctl.c	dm: introduce DM_GET_TARGET_VERSION	2019-09-16 10:18:01 -04:00
dm-kcopyd.c	dm kcopyd: always complete failed jobs	2019-08-15 15:57:39 -04:00
dm-linear.c	block: rework zone reporting	2019-11-12 19:12:07 -07:00
dm-log-userspace-base.c	dm: convert to bioset_init()/mempool_init()	2018-05-30 15:33:32 -06:00
dm-log-userspace-transfer.c
dm-log-userspace-transfer.h
dm-log-writes.c	dm log writes: fix incorrect comment about the logged sequence example	2019-07-09 14:13:33 -04:00
dm-log.c
dm-mpath.c	dm mpath: remove harmful bio-based optimization	2019-11-26 10:22:46 -05:00
dm-mpath.h
dm-path-selector.c
dm-path-selector.h
dm-queue-length.c	dm mpath selector: more evenly distribute ties	2018-01-29 13:44:58 -05:00
dm-raid1.c	dm raid1: use struct_size() with kzalloc()	2019-08-26 11:05:32 -04:00
dm-raid.c	dm raid: Remove unnecessary negation of a shift in raid10_format_to_md_layout	2019-11-07 11:59:38 -05:00
dm-region-hash.c	- Error path bug fix for overflow tests (Dan)	2018-06-12 18:28:00 -07:00
dm-round-robin.c
dm-rq.c	block: Delay default elevator initialization	2019-09-05 19:52:34 -06:00
dm-rq.h	dm: remove unused _rq_tio_cache and _rq_cache	2019-03-05 14:48:50 -05:00
dm-service-time.c	dm mpath selector: more evenly distribute ties	2018-01-29 13:44:58 -05:00
dm-snap-persistent.c	block: fix an integer overflow in logical block size	2020-01-15 21:43:09 -07:00
dm-snap-transient.c
dm-snap.c	dm snapshot: rework COW throttling to fix deadlock	2019-10-10 09:46:05 -04:00
dm-stats.c	dm stats: use struct_size() helper	2019-09-04 09:39:22 -04:00
dm-stats.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
dm-stripe.c	dm stripe: use struct_size() in kmalloc()	2019-11-05 14:09:59 -05:00
dm-switch.c	dm switch: use struct_size() in kzalloc()	2019-03-05 14:48:51 -05:00
dm-sysfs.c	dm: remove legacy request-based IO path	2018-10-11 11:36:09 -04:00
dm-table.c	block: don't handle bio based drivers in blk_revalidate_disk_zones	2019-12-03 08:51:25 -07:00
dm-target.c	dm mpath: fix missing call of path selector type->end_io	2019-04-25 15:38:52 -04:00
dm-thin-metadata.c	dm thin metadata: Add support for a pre-commit callback	2019-12-05 17:05:24 -05:00
dm-thin-metadata.h	dm thin metadata: Add support for a pre-commit callback	2019-12-05 17:05:24 -05:00
dm-thin.c	dm thin: Flush data device before committing metadata	2019-12-06 11:46:16 -05:00
dm-uevent.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156	2019-05-30 11:26:35 -07:00
dm-uevent.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156	2019-05-30 11:26:35 -07:00
dm-unstripe.c	dm: Check for device sector overflow if CONFIG_LBDAF is not set	2018-12-18 09:02:26 -05:00
dm-verity-fec.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
dm-verity-fec.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
dm-verity-target.c	dm verity: add root hash pkcs#7 signature verification	2019-08-23 10:13:14 -04:00
dm-verity-verify-sig.c	dm verity: add root hash pkcs#7 signature verification	2019-08-23 10:13:14 -04:00
dm-verity-verify-sig.h	dm verity: add root hash pkcs#7 signature verification	2019-08-23 10:13:14 -04:00
dm-verity.h	dm verity: add root hash pkcs#7 signature verification	2019-08-23 10:13:14 -04:00
dm-writecache.c	dm writecache: handle REQ_FUA	2019-11-05 14:21:40 -05:00
dm-zero.c
dm-zoned-metadata.c	- Fix DM core to disallow stacking request-based DM on partitions.	2019-11-25 11:53:26 -08:00
dm-zoned-reclaim.c	dm zoned: reduce overhead of backing device checks	2019-11-07 10:08:36 -05:00
dm-zoned-target.c	block: simplify blkdev_nr_zones	2019-12-03 08:51:24 -07:00
dm-zoned.h	dm zoned: reduce overhead of backing device checks	2019-11-07 10:08:36 -05:00
dm.c	block: rework zone reporting	2019-11-12 19:12:07 -07:00
dm.h	dm: make dm_table_find_target return NULL	2019-08-23 10:13:12 -04:00
Kconfig	dm: Fix Kconfig indentation	2019-11-20 10:35:31 -05:00
Makefile	dm: add clone target	2019-09-12 09:32:31 -04:00
md-bitmap.c	md: introduce a new struct for IO serialization	2020-01-13 11:44:10 -08:00
md-bitmap.h	md: Avoid namespace collision with bitmap API	2018-08-01 15:49:39 -07:00
md-cluster.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 45	2019-05-24 17:27:12 +02:00
md-cluster.h	md-cluster: introduce resync_info_get interface for sanity check	2018-10-18 09:36:35 -07:00
md-faulty.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 47	2019-05-24 17:27:13 +02:00
md-linear.c	md: improve handling of bio with REQ_PREFLUSH in md_flush_request()	2019-10-24 15:22:40 -07:00
md-linear.h	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md	2017-11-14 16:07:26 -08:00
md-multipath.c	md: improve handling of bio with REQ_PREFLUSH in md_flush_request()	2019-10-24 15:22:40 -07:00
md-multipath.h	md: convert to bioset_init()/mempool_init()	2018-05-30 15:33:32 -06:00
md.c	md/raid1: use bucket based mechanism for IO serialization	2020-01-13 11:44:10 -08:00
md.h	md: introduce a new struct for IO serialization	2020-01-13 11:44:10 -08:00
raid0.c	block: fix an integer overflow in logical block size	2020-01-15 21:43:09 -07:00
raid0.h	md/raid0: avoid RAID0 data corruption due to layout confusion.	2019-09-13 13:10:05 -07:00
raid1-10.c	md: raid1-10: Unify r{1,10}bio_pool_free	2019-06-15 01:37:35 -06:00
raid1.c	md/raid1: introduce wait_for_serialization	2020-01-13 11:44:10 -08:00
raid1.h	md: convert to bioset_init()/mempool_init()	2018-05-30 15:33:32 -06:00
raid5-cache.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288	2019-06-05 17:36:37 +02:00
raid5-log.h	raid5: set write hint for PPL	2019-03-12 10:15:18 -07:00
raid5-ppl.c	treewide: Use sizeof_field() macro	2019-12-09 10:36:44 -08:00
raid5.c	raid5: remove worker_cnt_per_group argument from alloc_thread_groups	2020-01-13 11:44:09 -08:00
raid5.h	raid5: use bio_end_sector in r5_next_bio	2019-09-13 13:14:43 -07:00
raid10.c	md/raid10: prevent access of uninitialized resync_pages offset	2019-11-11 16:47:39 -08:00
raid10.h	md: convert to bioset_init()/mempool_init()	2018-05-30 15:33:32 -06:00