similar to: [PATCH 4/4] virtio_blk: Rename a jump label in virtblk_get_id()

On Tue, Sep 13, 2016 at 1:15 PM, SF Markus Elfring <elfring at users.sourceforge.net> wrote: > From: Markus Elfring <elfring at users.sourceforge.net> > Date: Tue, 13 Sep 2016 13:50:56 +0200 > > Adjust a jump label according to the current Linux coding style convention. I think you mean "goto label". "Jump label" has a different meaning, see

On Tue, Sep 13, 2016 at 1:15 PM, SF Markus Elfring <elfring at users.sourceforge.net> wrote: > From: Markus Elfring <elfring at users.sourceforge.net> > Date: Tue, 13 Sep 2016 13:50:56 +0200 > > Adjust a jump label according to the current Linux coding style convention. I think you mean "goto label". "Jump label" has a different meaning, see

This is fairly simple: we create a request pointing at the 1k kmalloc, then just change the type so our do_req() knows to mark it as a GET_ID for the server. Seems to work here; the only issue is that the error didn't get passed back from __blk_end_request_all to blk_execute_rq, so we set ->errors to 1 on error. Signed-off-by: Rusty Russell <rusty at rustcorp.com.au> Cc: Jens Axboe

This is fairly simple: we create a request pointing at the 1k kmalloc, then just change the type so our do_req() knows to mark it as a GET_ID for the server. Seems to work here; the only issue is that the error didn't get passed back from __blk_end_request_all to blk_execute_rq, so we set ->errors to 1 on error. Signed-off-by: Rusty Russell <rusty at rustcorp.com.au> Cc: Jens Axboe

Create a new attribute for virtio-blk devices that will fetch the serial number of the block device. This attribute can be used by udev to create disk/by-id symlinks for devices that don't have a UUID (filesystem) associated with them. ATA_IDENTIFY strings are special in that they can be up to 20 chars long and aren't required to be NULL-terminated. The buffer is also zero-padded

Create a new attribute for virtio-blk devices that will fetch the serial number of the block device. This attribute can be used by udev to create disk/by-id symlinks for devices that don't have a UUID (filesystem) associated with them. ATA_IDENTIFY strings are special in that they can be up to 20 chars long and aren't required to be NULL-terminated. The buffer is also zero-padded

On Tue, Sep 13, 2016 at 1:14 PM, SF Markus Elfring <elfring at users.sourceforge.net> wrote: > From: Markus Elfring <elfring at users.sourceforge.net> > Date: Tue, 13 Sep 2016 13:43:50 +0200 > > The local variable "err" will be set to an appropriate value > by a following statement. > Thus omit the explicit initialisation at the beginning. > >

On Tue, Sep 13, 2016 at 1:14 PM, SF Markus Elfring <elfring at users.sourceforge.net> wrote: > From: Markus Elfring <elfring at users.sourceforge.net> > Date: Tue, 13 Sep 2016 13:43:50 +0200 > > The local variable "err" will be set to an appropriate value > by a following statement. > Thus omit the explicit initialisation at the beginning. > >

On Thu, 30 Apr 2020 15:04:42 +0100 Stefan Hajnoczi <stefanha at redhat.com> wrote: > A userspace process holding a file descriptor to a virtio_blk device can > still invoke block_device_operations after hot unplug. This leads to a > use-after-free accessing vblk->vdev in virtblk_getgeo() when > ioctl(HDIO_GETGEO) is invoked: > > BUG: unable to handle kernel NULL

On Tue, Apr 28, 2020 at 03:30:09PM +0100, Stefan Hajnoczi wrote: > A userspace process holding a file descriptor to a virtio_blk device can > still invoke block_device_operations after hot unplug. For example, a > program that has /dev/vdb open can call ioctl(HDIO_GETGEO) after hot > unplug to invoke virtblk_getgeo(). which causes what? a use after free? > > Introduce a

On Wed, Apr 29, 2020 at 05:53:45PM +0100, Stefan Hajnoczi wrote: > A userspace process holding a file descriptor to a virtio_blk device can > still invoke block_device_operations after hot unplug. This leads to a > use-after-free accessing vblk->vdev in virtblk_getgeo() when > ioctl(HDIO_GETGEO) is invoked: > > BUG: unable to handle kernel NULL pointer dereference at

From: Stefan Hajnoczi <stefanha at redhat.com> [ Upstream commit 90b5feb8c4bebc76c27fcaf3e1a0e5ca2d319e9e ] A userspace process holding a file descriptor to a virtio_blk device can still invoke block_device_operations after hot unplug. This leads to a use-after-free accessing vblk->vdev in virtblk_getgeo() when ioctl(HDIO_GETGEO) is invoked: BUG: unable to handle kernel NULL pointer

From: Stefan Hajnoczi <stefanha at redhat.com> [ Upstream commit 90b5feb8c4bebc76c27fcaf3e1a0e5ca2d319e9e ] A userspace process holding a file descriptor to a virtio_blk device can still invoke block_device_operations after hot unplug. This leads to a use-after-free accessing vblk->vdev in virtblk_getgeo() when ioctl(HDIO_GETGEO) is invoked: BUG: unable to handle kernel NULL pointer

From: Stefan Hajnoczi <stefanha at redhat.com> [ Upstream commit 90b5feb8c4bebc76c27fcaf3e1a0e5ca2d319e9e ] A userspace process holding a file descriptor to a virtio_blk device can still invoke block_device_operations after hot unplug. This leads to a use-after-free accessing vblk->vdev in virtblk_getgeo() when ioctl(HDIO_GETGEO) is invoked: BUG: unable to handle kernel NULL pointer

From: Stefan Hajnoczi <stefanha at redhat.com> [ Upstream commit 90b5feb8c4bebc76c27fcaf3e1a0e5ca2d319e9e ] A userspace process holding a file descriptor to a virtio_blk device can still invoke block_device_operations after hot unplug. This leads to a use-after-free accessing vblk->vdev in virtblk_getgeo() when ioctl(HDIO_GETGEO) is invoked: BUG: unable to handle kernel NULL pointer

On Tue, Apr 28, 2020 at 11:25:07AM -0400, Michael S. Tsirkin wrote: > On Tue, Apr 28, 2020 at 03:30:09PM +0100, Stefan Hajnoczi wrote: > > A userspace process holding a file descriptor to a virtio_blk device can > > still invoke block_device_operations after hot unplug. For example, a > > program that has /dev/vdb open can call ioctl(HDIO_GETGEO) after hot > > unplug to

A userspace process holding a file descriptor to a virtio_blk device can still invoke block_device_operations after hot unplug. This leads to a use-after-free accessing vblk->vdev in virtblk_getgeo() when ioctl(HDIO_GETGEO) is invoked: BUG: unable to handle kernel NULL pointer dereference at 0000000000000090 IP: [<ffffffffc00e5450>] virtio_check_driver_offered_feature+0x10/0x90

A userspace process holding a file descriptor to a virtio_blk device can still invoke block_device_operations after hot unplug. This leads to a use-after-free accessing vblk->vdev in virtblk_getgeo() when ioctl(HDIO_GETGEO) is invoked: BUG: unable to handle kernel NULL pointer dereference at 0000000000000090 IP: [<ffffffffc00e5450>] virtio_check_driver_offered_feature+0x10/0x90

A userspace process holding a file descriptor to a virtio_blk device can still invoke block_device_operations after hot unplug. For example, a program that has /dev/vdb open can call ioctl(HDIO_GETGEO) after hot unplug to invoke virtblk_getgeo(). Introduce a reference count in struct virtio_blk so that its lifetime covers both virtio_driver probe/remove and block_device_operations open/release

A userspace process holding a file descriptor to a virtio_blk device can still invoke block_device_operations after hot unplug. For example, a program that has /dev/vdb open can call ioctl(HDIO_GETGEO) after hot unplug to invoke virtblk_getgeo(). Introduce a reference count in struct virtio_blk so that its lifetime covers both virtio_driver probe/remove and block_device_operations open/release