Skip to content

Commit 14a5a70

Browse files
bvanasschekawasaki
bvanassche
authored and
kawasaki
committed
Revert "null_blk: allow byte aligned memory offsets"
This reverts commit 3451cf3 and fixes the following KASAN complaint when running test zbd/013: BUG: KASAN: slab-use-after-free in null_handle_data_transfer+0x88c/0xe50 [null_blk] Write of size 4096 at addr ffff8881ab162000 by task (udev-worker)/78072 CPU: 8 UID: 0 PID: 78072 Comm: (udev-worker) Not tainted 6.18.0-rc5-dbg #14 PREEMPT 737e33391e24fa2fcd9958673f6992b5ee131a07 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> show_stack+0x4d/0x60 dump_stack_lvl+0x61/0x80 print_address_description.constprop.0+0x8b/0x310 print_report+0xfd/0x1d7 kasan_report+0xde/0x1c0 kasan_check_range+0x10c/0x1f0 __asan_memcpy+0x3f/0x70 null_handle_data_transfer+0x88c/0xe50 [null_blk] null_process_cmd+0x1a4/0x370 [null_blk] null_process_zoned_cmd+0x1ff/0x3c0 [null_blk] null_handle_cmd+0x1bd/0x580 [null_blk] null_queue_rq+0x568/0x970 [null_blk] null_queue_rqs+0xe5/0x2b0 [null_blk] __blk_mq_flush_list+0x83/0xb0 blk_mq_dispatch_queue_requests+0x3d7/0x660 blk_mq_flush_plug_list+0x1a1/0x730 __blk_flush_plug+0x290/0x540 blk_finish_plug+0x53/0xc0 read_pages+0x456/0xad0 page_cache_ra_unbounded+0x3cd/0x6e0 force_page_cache_ra+0x1f0/0x370 page_cache_sync_ra+0x158/0x870 filemap_get_pages+0x327/0xcb0 filemap_read+0x336/0xd30 blkdev_read_iter+0x15c/0x430 vfs_read+0x79a/0x1150 ksys_read+0xfd/0x230 __x64_sys_read+0x76/0xc0 x64_sys_call+0x143c/0x17e0 do_syscall_64+0x96/0x360 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> Allocated by task 0 on cpu 0 at 3226.274686s: kasan_save_stack+0x2a/0x50 kasan_save_track+0x1c/0x70 kasan_save_alloc_info+0x3d/0x50 __kasan_kmalloc+0xa0/0xb0 __kmalloc_cache_noprof+0x2e9/0x8a0 kmem_cache_free+0x590/0x870 mempool_free_slab+0x1b/0x20 mempool_free+0xd1/0x9b0 bio_free+0x15e/0x1c0 bio_put+0x34f/0x790 bio_endio+0x31d/0x6c0 blk_update_request+0x425/0xfb0 blk_mq_end_request+0x5d/0x370 null_cmd_timer_expired+0x43/0x60 [null_blk] __hrtimer_run_queues+0x53e/0xb40 hrtimer_interrupt+0x32f/0x850 __sysvec_apic_timer_interrupt+0xdc/0x360 sysvec_apic_timer_interrupt+0xa4/0xe0 asm_sysvec_apic_timer_interrupt+0x1f/0x30 Freed by task 14 on cpu 0 at 3226.398721s: kasan_save_stack+0x2a/0x50 kasan_save_track+0x1c/0x70 __kasan_save_free_info+0x3f/0x60 __kasan_slab_free+0x67/0x80 kfree+0x170/0x780 slab_free_after_rcu_debug+0x6c/0x250 rcu_do_batch+0x369/0x13f0 rcu_core+0x385/0x5a0 rcu_core_si+0x12/0x20 handle_softirqs+0x1a3/0x930 run_ksoftirqd+0x3e/0x60 smpboot_thread_fn+0x311/0xa00 kthread+0x3cc/0x830 ret_from_fork+0x39c/0x500 ret_from_fork_asm+0x11/0x20 Last potentially related work creation: kasan_save_stack+0x2a/0x50 kasan_record_aux_stack+0xad/0xc0 __call_rcu_common.constprop.0+0xfb/0xbb0 call_rcu+0x12/0x20 kmem_cache_free+0x5bc/0x870 mempool_free_slab+0x1b/0x20 mempool_free+0xd1/0x9b0 bio_free+0x15e/0x1c0 bio_put+0x34f/0x790 bio_endio+0x31d/0x6c0 blk_update_request+0x425/0xfb0 blk_mq_end_request+0x5d/0x370 null_cmd_timer_expired+0x43/0x60 [null_blk] __hrtimer_run_queues+0x53e/0xb40 hrtimer_interrupt+0x32f/0x850 __sysvec_apic_timer_interrupt+0xdc/0x360 sysvec_apic_timer_interrupt+0xa4/0xe0 asm_sysvec_apic_timer_interrupt+0x1f/0x30 The buggy address belongs to the object at ffff8881ab162000 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 0 bytes inside of freed 32-byte region [ffff8881ab162000, ffff8881ab162020) Cc: Keith Busch <[email protected]> Signed-off-by: Bart Van Assche <[email protected]>
1 parent c622f6c commit 14a5a70

2 files changed

Lines changed: 22 additions & 25 deletions

File tree

‎drivers/block/null_blk/main.c‎

Lines changed: 21 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1130,61 +1130,59 @@ static int null_make_cache_space(struct nullb *nullb, unsigned long n)
11301130
}
11311131

11321132
static blk_status_t copy_to_nullb(struct nullb *nullb, void *source,
1133-
loff_t pos, size_t n, bool is_fua)
1133+
sector_t sector, size_t n, bool is_fua)
11341134
{
11351135
size_t temp, count = 0;
1136+
unsigned int offset;
11361137
struct nullb_page *t_page;
1137-
sector_t sector;
11381138

11391139
while (count < n) {
1140-
temp = min3(nullb->dev->blocksize, n - count,
1141-
PAGE_SIZE - offset_in_page(pos));
1142-
sector = pos >> SECTOR_SHIFT;
1140+
temp = min_t(size_t, nullb->dev->blocksize, n - count);
11431141

11441142
if (null_cache_active(nullb) && !is_fua)
11451143
null_make_cache_space(nullb, PAGE_SIZE);
11461144

1145+
offset = (sector & SECTOR_MASK) << SECTOR_SHIFT;
11471146
t_page = null_insert_page(nullb, sector,
11481147
!null_cache_active(nullb) || is_fua);
11491148
if (!t_page)
11501149
return BLK_STS_NOSPC;
11511150

1152-
memcpy_to_page(t_page->page, offset_in_page(pos),
1153-
source + count, temp);
1151+
memcpy_to_page(t_page->page, offset, source + count, temp);
11541152

11551153
__set_bit(sector & SECTOR_MASK, t_page->bitmap);
11561154

11571155
if (is_fua)
11581156
null_free_sector(nullb, sector, true);
11591157

11601158
count += temp;
1161-
pos += temp;
1159+
sector += temp >> SECTOR_SHIFT;
11621160
}
11631161
return BLK_STS_OK;
11641162
}
11651163

1166-
static void copy_from_nullb(struct nullb *nullb, void *dest, loff_t pos,
1164+
static void copy_from_nullb(struct nullb *nullb, void *dest, sector_t sector,
11671165
size_t n)
11681166
{
11691167
size_t temp, count = 0;
1168+
unsigned int offset;
11701169
struct nullb_page *t_page;
1171-
sector_t sector;
11721170

11731171
while (count < n) {
1174-
temp = min3(nullb->dev->blocksize, n - count,
1175-
PAGE_SIZE - offset_in_page(pos));
1176-
sector = pos >> SECTOR_SHIFT;
1172+
temp = min_t(size_t, nullb->dev->blocksize, n - count);
11771173

1174+
offset = (sector & SECTOR_MASK) << SECTOR_SHIFT;
11781175
t_page = null_lookup_page(nullb, sector, false,
11791176
!null_cache_active(nullb));
1177+
11801178
if (t_page)
1181-
memcpy_from_page(dest + count, t_page->page,
1182-
offset_in_page(pos), temp);
1179+
memcpy_from_page(dest + count, t_page->page, offset,
1180+
temp);
11831181
else
11841182
memset(dest + count, 0, temp);
11851183

11861184
count += temp;
1187-
pos += temp;
1185+
sector += temp >> SECTOR_SHIFT;
11881186
}
11891187
}
11901188

@@ -1230,7 +1228,7 @@ static blk_status_t null_handle_flush(struct nullb *nullb)
12301228
}
12311229

12321230
static blk_status_t null_transfer(struct nullb *nullb, struct page *page,
1233-
unsigned int len, unsigned int off, bool is_write, loff_t pos,
1231+
unsigned int len, unsigned int off, bool is_write, sector_t sector,
12341232
bool is_fua)
12351233
{
12361234
struct nullb_device *dev = nullb->dev;
@@ -1242,10 +1240,10 @@ static blk_status_t null_transfer(struct nullb *nullb, struct page *page,
12421240
if (!is_write) {
12431241
if (dev->zoned)
12441242
valid_len = null_zone_valid_read_len(nullb,
1245-
pos >> SECTOR_SHIFT, len);
1243+
sector, len);
12461244

12471245
if (valid_len) {
1248-
copy_from_nullb(nullb, p, pos, valid_len);
1246+
copy_from_nullb(nullb, p, sector, valid_len);
12491247
off += valid_len;
12501248
len -= valid_len;
12511249
}
@@ -1255,7 +1253,7 @@ static blk_status_t null_transfer(struct nullb *nullb, struct page *page,
12551253
flush_dcache_page(page);
12561254
} else {
12571255
flush_dcache_page(page);
1258-
err = copy_to_nullb(nullb, p, pos, len, is_fua);
1256+
err = copy_to_nullb(nullb, p, sector, len, is_fua);
12591257
}
12601258

12611259
kunmap_local(p);
@@ -1273,7 +1271,7 @@ static blk_status_t null_handle_data_transfer(struct nullb_cmd *cmd,
12731271
struct nullb *nullb = cmd->nq->dev->nullb;
12741272
blk_status_t err = BLK_STS_OK;
12751273
unsigned int len;
1276-
loff_t pos = blk_rq_pos(rq) << SECTOR_SHIFT;
1274+
sector_t sector = blk_rq_pos(rq);
12771275
unsigned int max_bytes = nr_sectors << SECTOR_SHIFT;
12781276
unsigned int transferred_bytes = 0;
12791277
struct req_iterator iter;
@@ -1285,11 +1283,11 @@ static blk_status_t null_handle_data_transfer(struct nullb_cmd *cmd,
12851283
if (transferred_bytes + len > max_bytes)
12861284
len = max_bytes - transferred_bytes;
12871285
err = null_transfer(nullb, bvec.bv_page, len, bvec.bv_offset,
1288-
op_is_write(req_op(rq)), pos,
1286+
op_is_write(req_op(rq)), sector,
12891287
rq->cmd_flags & REQ_FUA);
12901288
if (err)
12911289
break;
1292-
pos += len;
1290+
sector += len >> SECTOR_SHIFT;
12931291
transferred_bytes += len;
12941292
if (transferred_bytes >= max_bytes)
12951293
break;
@@ -1946,7 +1944,6 @@ static int null_add_dev(struct nullb_device *dev)
19461944
.logical_block_size = dev->blocksize,
19471945
.physical_block_size = dev->blocksize,
19481946
.max_hw_sectors = dev->max_sectors,
1949-
.dma_alignment = 1,
19501947
};
19511948

19521949
struct nullb *nullb;

‎drivers/block/null_blk/zoned.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ size_t null_zone_valid_read_len(struct nullb *nullb,
242242
{
243243
struct nullb_device *dev = nullb->dev;
244244
struct nullb_zone *zone = &dev->zones[null_zone_no(dev, sector)];
245-
unsigned int nr_sectors = DIV_ROUND_UP(len, SECTOR_SHIFT);
245+
unsigned int nr_sectors = len >> SECTOR_SHIFT;
246246

247247
/* Read must be below the write pointer position */
248248
if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL ||

0 commit comments

Comments
 (0)