In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
block: stop the timeout timer when releasing a never added disk<\/p>\n
disk_release() undoes blk_mq_init_allocated_queue() for a disk whose
\nprobe failed before add_disk(), but it only calls blk_mq_exit_queue().
\nNothing there stops q->timeout, and that timer rolls forward: it stays
\npending until it next expires, not until the last request completes.
\nSo if the driver issued any I\/O before adding the disk, the
\nrequest_queue is freed while still linked into a timer wheel bucket.<\/p>\n
Commit 6f8191fdf41d (“block: simplify disk shutdown”) dropped the
\nblk_cleanup_queue() call that used to stop it. __del_gendisk() and
\nblk_mq_destroy_queue() still do; only the probe failure path lost it.<\/p>\n
nvme gets there because nvme_update_ns_info() submits Report Zones or
\nFDP io-mgmt-recv on ns->queue before the disk is added, so a later
\nfailure – a concurrent reset setting NVME_CTRL_FROZEN, or
\ndevice_add_disk() failing – lands in put_disk() with the timer armed:<\/p>\n
BUG: KASAN: slab-use-after-free in detach_if_pending+0x30c\/0x340
\n Write of size 8 at addr ffff888004d71310 by task kworker\/u8:2\/37
\n __timer_delete_sync+0x156\/0x240 kernel\/time\/timer.c:1621
\n blk_sync_queue+0x22\/0x40 block\/blk-core.c:222
\n nvme_sync_queues+0x100\/0x150 drivers\/nvme\/host\/core.c:5362
\n nvme_reset_work+0x138\/0x930 drivers\/nvme\/host\/pci.c:3264<\/p>\n
Allocated by task 34:
\n __blk_mq_alloc_disk+0x33\/0x100 block\/blk-mq.c:4462
\n nvme_alloc_ns+0x290\/0x3870 drivers\/nvme\/host\/core.c:4146<\/p>\n
Freed by task 0:
\n blk_free_queue_rcu+0x3a\/0x50 block\/blk-core.c:254
\n rcu_core+0xc10\/0x1730 kernel\/rcu\/tree.c:2857<\/p>\n
The queue being synced there is ctrl->admin_q, only a victim sharing a
\ntimer wheel bucket with the freed queue’s dangling entry; other runs
\ntripped in enqueue_timer(), __run_timers() or blk_mq_timeout_work().
\nFailing nvme_alloc_ns() with a debug patch makes it deterministic: one
\nleaked timer trips KASAN within seconds, while 1987 patched releases
\nproduced no splat.<\/p>\n
Stop the timer and the queue work items before blk_mq_exit_queue(), like
\nblk_mq_destroy_queue() does.<\/p>\n
Found by FuzzNvme.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
block: stop the timeout timer when releasing a never added disk<\/p>\n
disk_release() undoes blk_mq_init_allocated_queue() for a disk who<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11985","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11985","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11985"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11985"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11985"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}