Lars Ellenberg 64dafbc953 drbd: fix access after free ... We have struct drbd_requests { ... struct bio *private_bio; ... } to hold a bio clone for local submission. On local IO completion, we put that bio, and in case we want to use the result later, we overload that member to hold the ERR_PTR() of the completion result, Which, before v4.3, used to be the passed in "int error", so we could first bio_put(), then assign. v4.3-rc1~100^2~21 4246a0b63b block: add a bi_error field to struct bio changed that: bio_put(req->private_bio); - req->private_bio = ERR_PTR(error); + req->private_bio = ERR_PTR(bio->bi_error); Which introduces an access after free, because it was non obvious that req->private_bio == bio. Impact of that was mostly unnoticable, because we only use that value in a multiple-failure case, and even then map any "unexpected" error code to EIO, so worst case we could potentially mask a more specific error with EIO in a multiple failure case. Unless the pointed to memory region was unmapped, as is the case with CONFIG_DEBUG_PAGEALLOC, in which case this results in BUG: unable to handle kernel paging request v4.13-rc1~70^2~75 4e4cbee93d block: switch bios to blk_status_t changes it further to bio_put(req->private_bio); req->private_bio = ERR_PTR(blk_status_to_errno(bio->bi_status)); And blk_status_to_errno() now contains a WARN_ON_ONCE() for unexpected values, which catches this "sometimes", if the memory has been reused quickly enough for other things. Should also go into stable since 4.3, with the trivial change around 4.13. Cc: stable@vger.kernel.org Fixes: 4246a0b63b block: add a bi_error field to struct bio Reported-by: Sarah Newman <srn@prgmr.com> Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>		2018-07-02 08:22:25 -06:00
..
drbd_actlog.c	block: replace bi_bdev with a gendisk pointer and partitions index	2017-08-23 12:49:55 -06:00
drbd_bitmap.c	drbd: convert to bioset_init()/mempool_init()	2018-05-30 15:33:32 -06:00
drbd_debugfs.c	block drivers/block: Use octal not symbolic permissions	2018-05-24 13:38:59 -06:00
drbd_debugfs.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
drbd_int.h	Merge branch 'hch.procfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-06-04 10:00:01 -07:00
drbd_interval.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
drbd_interval.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
drbd_main.c	Merge branch 'hch.procfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-06-04 10:00:01 -07:00
drbd_nl.c	block: Use blk_queue_flag_*() in drivers instead of queue_flag_*()	2018-03-08 14:13:48 -07:00
drbd_nla.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
drbd_nla.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
drbd_proc.c	drbd: switch to proc_create_single	2018-05-16 07:24:30 +02:00
drbd_protocol.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
drbd_receiver.c	drbd: convert to bioset_init()/mempool_init()	2018-05-30 15:33:32 -06:00
drbd_req.c	drbd: Fix drbd_request_prepare() discard handling	2018-06-29 07:53:21 -06:00
drbd_req.h	drbd: convert to bioset_init()/mempool_init()	2018-05-30 15:33:32 -06:00
drbd_state_change.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
drbd_state.c	drbd: fix potential deadlock when trying to detach during handshake	2017-08-29 15:34:45 -06:00
drbd_state.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
drbd_strings.c
drbd_strings.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
drbd_vli.h
drbd_worker.c	drbd: fix access after free	2018-07-02 08:22:25 -06:00
Kconfig	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00