Message ID | 20210524110836.49110-1-lyl2019@mail.ustc.edu.cn (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Series | drbd: Fix five use after free bugs in get_initial_state | expand |
Hi Lv, Thank you for the patch! Yet something to improve: [auto build test ERROR on block/for-next] [also build test ERROR on linux/master linus/master v5.13-rc3 next-20210524] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url: https://github.com/0day-ci/linux/commits/Lv-Yunlong/drbd-Fix-five-use-after-free-bugs-in-get_initial_state/20210524-191033 base: https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-next config: m68k-allmodconfig (attached as .config) compiler: m68k-linux-gcc (GCC) 9.3.0 reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/0day-ci/linux/commit/96d72dce0926dbbe4db1f95e5d04cc6b026d96f7 git remote add linux-review https://github.com/0day-ci/linux git fetch --no-tags linux-review Lv-Yunlong/drbd-Fix-five-use-after-free-bugs-in-get_initial_state/20210524-191033 git checkout 96d72dce0926dbbe4db1f95e5d04cc6b026d96f7 # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross ARCH=m68k If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp@intel.com> All error/warnings (new ones prefixed by >>): >> drivers/block/drbd/drbd_state.c:1570:6: error: conflicting types for 'notify_device_state_change' 1570 | void notify_device_state_change(struct sk_buff *skb, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/block/drbd/drbd_state.c:20: drivers/block/drbd/drbd_state_change.h:55:12: note: previous declaration of 'notify_device_state_change' was here 55 | extern int notify_device_state_change(struct sk_buff *, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/block/drbd/drbd_state.c: In function 'notify_device_state_change': drivers/block/drbd/drbd_state.c:1580:9: error: 'return' with a value, in function returning void [-Werror=return-type] 1580 | return notify_device_state(skb, seq, device, &device_info, type); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/block/drbd/drbd_state.c:1570:6: note: declared here 1570 | void notify_device_state_change(struct sk_buff *skb, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/block/drbd/drbd_state.c: In function 'broadcast_state_change': >> drivers/block/drbd/drbd_state.c:1616:17: warning: cast between incompatible function types from 'int (*)(struct sk_buff *, unsigned int, struct drbd_resource_state_change *, enum drbd_notification_type)' to 'void (*)(struct sk_buff *, unsigned int, void *, enum drbd_notification_type)' [-Wcast-function-type] 1616 | last_func = (typeof(last_func))func; \ | ^ drivers/block/drbd/drbd_state.c:1629:3: note: in expansion of macro 'REMEMBER_STATE_CHANGE' 1629 | REMEMBER_STATE_CHANGE(notify_resource_state_change, | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/block/drbd/drbd_state.c:1616:17: warning: cast between incompatible function types from 'int (*)(struct sk_buff *, unsigned int, struct drbd_connection_state_change *, enum drbd_notification_type)' to 'void (*)(struct sk_buff *, unsigned int, void *, enum drbd_notification_type)' [-Wcast-function-type] 1616 | last_func = (typeof(last_func))func; \ | ^ drivers/block/drbd/drbd_state.c:1638:4: note: in expansion of macro 'REMEMBER_STATE_CHANGE' 1638 | REMEMBER_STATE_CHANGE(notify_connection_state_change, | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/block/drbd/drbd_state.c:1616:17: warning: cast between incompatible function types from 'int (*)(struct sk_buff *, unsigned int, struct drbd_peer_device_state_change *, enum drbd_notification_type)' to 'void (*)(struct sk_buff *, unsigned int, void *, enum drbd_notification_type)' [-Wcast-function-type] 1616 | last_func = (typeof(last_func))func; \ | ^ drivers/block/drbd/drbd_state.c:1661:4: note: in expansion of macro 'REMEMBER_STATE_CHANGE' 1661 | REMEMBER_STATE_CHANGE(notify_peer_device_state_change, | ^~~~~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/notify_device_state_change +1570 drivers/block/drbd/drbd_state.c a29728463b254c Andreas Gruenbacher 2014-07-31 1569 a29728463b254c Andreas Gruenbacher 2014-07-31 @1570 void notify_device_state_change(struct sk_buff *skb, a29728463b254c Andreas Gruenbacher 2014-07-31 1571 unsigned int seq, a29728463b254c Andreas Gruenbacher 2014-07-31 1572 struct drbd_device_state_change *device_state_change, a29728463b254c Andreas Gruenbacher 2014-07-31 1573 enum drbd_notification_type type) a29728463b254c Andreas Gruenbacher 2014-07-31 1574 { a29728463b254c Andreas Gruenbacher 2014-07-31 1575 struct drbd_device *device = device_state_change->device; a29728463b254c Andreas Gruenbacher 2014-07-31 1576 struct device_info device_info = { a29728463b254c Andreas Gruenbacher 2014-07-31 1577 .dev_disk_state = device_state_change->disk_state[NEW], a29728463b254c Andreas Gruenbacher 2014-07-31 1578 }; a29728463b254c Andreas Gruenbacher 2014-07-31 1579 96d72dce0926db Lv Yunlong 2021-05-24 1580 return notify_device_state(skb, seq, device, &device_info, type); a29728463b254c Andreas Gruenbacher 2014-07-31 1581 } a29728463b254c Andreas Gruenbacher 2014-07-31 1582 96d72dce0926db Lv Yunlong 2021-05-24 1583 int notify_peer_device_state_change(struct sk_buff *skb, a29728463b254c Andreas Gruenbacher 2014-07-31 1584 unsigned int seq, a29728463b254c Andreas Gruenbacher 2014-07-31 1585 struct drbd_peer_device_state_change *p, a29728463b254c Andreas Gruenbacher 2014-07-31 1586 enum drbd_notification_type type) a29728463b254c Andreas Gruenbacher 2014-07-31 1587 { a29728463b254c Andreas Gruenbacher 2014-07-31 1588 struct drbd_peer_device *peer_device = p->peer_device; a29728463b254c Andreas Gruenbacher 2014-07-31 1589 struct peer_device_info peer_device_info = { a29728463b254c Andreas Gruenbacher 2014-07-31 1590 .peer_repl_state = p->repl_state[NEW], a29728463b254c Andreas Gruenbacher 2014-07-31 1591 .peer_disk_state = p->disk_state[NEW], a29728463b254c Andreas Gruenbacher 2014-07-31 1592 .peer_resync_susp_user = p->resync_susp_user[NEW], a29728463b254c Andreas Gruenbacher 2014-07-31 1593 .peer_resync_susp_peer = p->resync_susp_peer[NEW], a29728463b254c Andreas Gruenbacher 2014-07-31 1594 .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], a29728463b254c Andreas Gruenbacher 2014-07-31 1595 }; a29728463b254c Andreas Gruenbacher 2014-07-31 1596 96d72dce0926db Lv Yunlong 2021-05-24 1597 return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); a29728463b254c Andreas Gruenbacher 2014-07-31 1598 } a29728463b254c Andreas Gruenbacher 2014-07-31 1599 a29728463b254c Andreas Gruenbacher 2014-07-31 1600 static void broadcast_state_change(struct drbd_state_change *state_change) a29728463b254c Andreas Gruenbacher 2014-07-31 1601 { a29728463b254c Andreas Gruenbacher 2014-07-31 1602 struct drbd_resource_state_change *resource_state_change = &state_change->resource[0]; a29728463b254c Andreas Gruenbacher 2014-07-31 1603 bool resource_state_has_changed; a29728463b254c Andreas Gruenbacher 2014-07-31 1604 unsigned int n_device, n_connection, n_peer_device, n_peer_devices; a29728463b254c Andreas Gruenbacher 2014-07-31 1605 void (*last_func)(struct sk_buff *, unsigned int, void *, a29728463b254c Andreas Gruenbacher 2014-07-31 1606 enum drbd_notification_type) = NULL; 805cdb8bc6da87 Kees Cook 2020-06-03 1607 void *last_arg = NULL; a29728463b254c Andreas Gruenbacher 2014-07-31 1608 a29728463b254c Andreas Gruenbacher 2014-07-31 1609 #define HAS_CHANGED(state) ((state)[OLD] != (state)[NEW]) a29728463b254c Andreas Gruenbacher 2014-07-31 1610 #define FINAL_STATE_CHANGE(type) \ a29728463b254c Andreas Gruenbacher 2014-07-31 1611 ({ if (last_func) \ a29728463b254c Andreas Gruenbacher 2014-07-31 1612 last_func(NULL, 0, last_arg, type); \ a29728463b254c Andreas Gruenbacher 2014-07-31 1613 }) a29728463b254c Andreas Gruenbacher 2014-07-31 1614 #define REMEMBER_STATE_CHANGE(func, arg, type) \ a29728463b254c Andreas Gruenbacher 2014-07-31 1615 ({ FINAL_STATE_CHANGE(type | NOTIFY_CONTINUES); \ a29728463b254c Andreas Gruenbacher 2014-07-31 @1616 last_func = (typeof(last_func))func; \ a29728463b254c Andreas Gruenbacher 2014-07-31 1617 last_arg = arg; \ a29728463b254c Andreas Gruenbacher 2014-07-31 1618 }) a29728463b254c Andreas Gruenbacher 2014-07-31 1619 a29728463b254c Andreas Gruenbacher 2014-07-31 1620 mutex_lock(¬ification_mutex); a29728463b254c Andreas Gruenbacher 2014-07-31 1621 a29728463b254c Andreas Gruenbacher 2014-07-31 1622 resource_state_has_changed = a29728463b254c Andreas Gruenbacher 2014-07-31 1623 HAS_CHANGED(resource_state_change->role) || a29728463b254c Andreas Gruenbacher 2014-07-31 1624 HAS_CHANGED(resource_state_change->susp) || a29728463b254c Andreas Gruenbacher 2014-07-31 1625 HAS_CHANGED(resource_state_change->susp_nod) || a29728463b254c Andreas Gruenbacher 2014-07-31 1626 HAS_CHANGED(resource_state_change->susp_fen); a29728463b254c Andreas Gruenbacher 2014-07-31 1627 a29728463b254c Andreas Gruenbacher 2014-07-31 1628 if (resource_state_has_changed) a29728463b254c Andreas Gruenbacher 2014-07-31 1629 REMEMBER_STATE_CHANGE(notify_resource_state_change, a29728463b254c Andreas Gruenbacher 2014-07-31 1630 resource_state_change, NOTIFY_CHANGE); a29728463b254c Andreas Gruenbacher 2014-07-31 1631 a29728463b254c Andreas Gruenbacher 2014-07-31 1632 for (n_connection = 0; n_connection < state_change->n_connections; n_connection++) { a29728463b254c Andreas Gruenbacher 2014-07-31 1633 struct drbd_connection_state_change *connection_state_change = a29728463b254c Andreas Gruenbacher 2014-07-31 1634 &state_change->connections[n_connection]; a29728463b254c Andreas Gruenbacher 2014-07-31 1635 a29728463b254c Andreas Gruenbacher 2014-07-31 1636 if (HAS_CHANGED(connection_state_change->peer_role) || a29728463b254c Andreas Gruenbacher 2014-07-31 1637 HAS_CHANGED(connection_state_change->cstate)) a29728463b254c Andreas Gruenbacher 2014-07-31 1638 REMEMBER_STATE_CHANGE(notify_connection_state_change, a29728463b254c Andreas Gruenbacher 2014-07-31 1639 connection_state_change, NOTIFY_CHANGE); a29728463b254c Andreas Gruenbacher 2014-07-31 1640 } a29728463b254c Andreas Gruenbacher 2014-07-31 1641 a29728463b254c Andreas Gruenbacher 2014-07-31 1642 for (n_device = 0; n_device < state_change->n_devices; n_device++) { a29728463b254c Andreas Gruenbacher 2014-07-31 1643 struct drbd_device_state_change *device_state_change = a29728463b254c Andreas Gruenbacher 2014-07-31 1644 &state_change->devices[n_device]; a29728463b254c Andreas Gruenbacher 2014-07-31 1645 a29728463b254c Andreas Gruenbacher 2014-07-31 1646 if (HAS_CHANGED(device_state_change->disk_state)) a29728463b254c Andreas Gruenbacher 2014-07-31 1647 REMEMBER_STATE_CHANGE(notify_device_state_change, a29728463b254c Andreas Gruenbacher 2014-07-31 1648 device_state_change, NOTIFY_CHANGE); a29728463b254c Andreas Gruenbacher 2014-07-31 1649 } a29728463b254c Andreas Gruenbacher 2014-07-31 1650 a29728463b254c Andreas Gruenbacher 2014-07-31 1651 n_peer_devices = state_change->n_devices * state_change->n_connections; a29728463b254c Andreas Gruenbacher 2014-07-31 1652 for (n_peer_device = 0; n_peer_device < n_peer_devices; n_peer_device++) { a29728463b254c Andreas Gruenbacher 2014-07-31 1653 struct drbd_peer_device_state_change *p = a29728463b254c Andreas Gruenbacher 2014-07-31 1654 &state_change->peer_devices[n_peer_device]; a29728463b254c Andreas Gruenbacher 2014-07-31 1655 a29728463b254c Andreas Gruenbacher 2014-07-31 1656 if (HAS_CHANGED(p->disk_state) || a29728463b254c Andreas Gruenbacher 2014-07-31 1657 HAS_CHANGED(p->repl_state) || a29728463b254c Andreas Gruenbacher 2014-07-31 1658 HAS_CHANGED(p->resync_susp_user) || a29728463b254c Andreas Gruenbacher 2014-07-31 1659 HAS_CHANGED(p->resync_susp_peer) || a29728463b254c Andreas Gruenbacher 2014-07-31 1660 HAS_CHANGED(p->resync_susp_dependency)) a29728463b254c Andreas Gruenbacher 2014-07-31 1661 REMEMBER_STATE_CHANGE(notify_peer_device_state_change, a29728463b254c Andreas Gruenbacher 2014-07-31 1662 p, NOTIFY_CHANGE); a29728463b254c Andreas Gruenbacher 2014-07-31 1663 } a29728463b254c Andreas Gruenbacher 2014-07-31 1664 a29728463b254c Andreas Gruenbacher 2014-07-31 1665 FINAL_STATE_CHANGE(NOTIFY_CHANGE); a29728463b254c Andreas Gruenbacher 2014-07-31 1666 mutex_unlock(¬ification_mutex); a29728463b254c Andreas Gruenbacher 2014-07-31 1667 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h index 5d9181382ce1..0a5766a2f161 100644 --- a/drivers/block/drbd/drbd_int.h +++ b/drivers/block/drbd/drbd_int.h @@ -1642,22 +1642,22 @@ struct sib_info { }; void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib); -extern void notify_resource_state(struct sk_buff *, +extern int notify_resource_state(struct sk_buff *, unsigned int, struct drbd_resource *, struct resource_info *, enum drbd_notification_type); -extern void notify_device_state(struct sk_buff *, +extern int notify_device_state(struct sk_buff *, unsigned int, struct drbd_device *, struct device_info *, enum drbd_notification_type); -extern void notify_connection_state(struct sk_buff *, +extern int notify_connection_state(struct sk_buff *, unsigned int, struct drbd_connection *, struct connection_info *, enum drbd_notification_type); -extern void notify_peer_device_state(struct sk_buff *, +extern int notify_peer_device_state(struct sk_buff *, unsigned int, struct drbd_peer_device *, struct peer_device_info *, diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c index e7d0e637e632..18c4fea028e1 100644 --- a/drivers/block/drbd/drbd_nl.c +++ b/drivers/block/drbd/drbd_nl.c @@ -4617,7 +4617,7 @@ static int nla_put_notification_header(struct sk_buff *msg, return drbd_notification_header_to_skb(msg, &nh, true); } -void notify_resource_state(struct sk_buff *skb, +int notify_resource_state(struct sk_buff *skb, unsigned int seq, struct drbd_resource *resource, struct resource_info *resource_info, @@ -4659,16 +4659,17 @@ void notify_resource_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_device_state(struct sk_buff *skb, +int notify_device_state(struct sk_buff *skb, unsigned int seq, struct drbd_device *device, struct device_info *device_info, @@ -4708,16 +4709,17 @@ void notify_device_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_connection_state(struct sk_buff *skb, +int notify_connection_state(struct sk_buff *skb, unsigned int seq, struct drbd_connection *connection, struct connection_info *connection_info, @@ -4757,16 +4759,17 @@ void notify_connection_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_peer_device_state(struct sk_buff *skb, +int notify_peer_device_state(struct sk_buff *skb, unsigned int seq, struct drbd_peer_device *peer_device, struct peer_device_info *peer_device_info, @@ -4807,13 +4810,14 @@ void notify_peer_device_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } void notify_helper(enum drbd_notification_type type, @@ -4864,7 +4868,7 @@ void notify_helper(enum drbd_notification_type type, err, seq); } -static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) +static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq) { struct drbd_genlmsghdr *dh; int err; @@ -4878,11 +4882,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) if (nla_put_notification_header(skb, NOTIFY_EXISTS)) goto nla_put_failure; genlmsg_end(skb, dh); - return; + return 0; nla_put_failure: nlmsg_free(skb); pr_err("Error %d sending event. Event seq:%u\n", err, seq); + return err; } static void free_state_changes(struct list_head *list) @@ -4909,6 +4914,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) unsigned int seq = cb->args[2]; unsigned int n; enum drbd_notification_type flags = 0; + int err = 0; /* There is no need for taking notification_mutex here: it doesn't matter if the initial state events mix with later state chage @@ -4917,32 +4923,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) cb->args[5]--; if (cb->args[5] == 1) { - notify_initial_state_done(skb, seq); + err = notify_initial_state_done(skb, seq); goto out; } n = cb->args[4]++; if (cb->args[4] < cb->args[3]) flags |= NOTIFY_CONTINUES; if (n < 1) { - notify_resource_state_change(skb, seq, state_change->resource, + err = notify_resource_state_change(skb, seq, state_change->resource, NOTIFY_EXISTS | flags); goto next; } n--; if (n < state_change->n_connections) { - notify_connection_state_change(skb, seq, &state_change->connections[n], + err = notify_connection_state_change(skb, seq, &state_change->connections[n], NOTIFY_EXISTS | flags); goto next; } n -= state_change->n_connections; if (n < state_change->n_devices) { - notify_device_state_change(skb, seq, &state_change->devices[n], + err = notify_device_state_change(skb, seq, &state_change->devices[n], NOTIFY_EXISTS | flags); goto next; } n -= state_change->n_devices; if (n < state_change->n_devices * state_change->n_connections) { - notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], + err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], NOTIFY_EXISTS | flags); goto next; } @@ -4957,7 +4963,10 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) cb->args[4] = 0; } out: - return skb->len; + if (err) + return err; + else + return skb->len; } int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c index b8a27818ab3f..a0271209900c 100644 --- a/drivers/block/drbd/drbd_state.c +++ b/drivers/block/drbd/drbd_state.c @@ -1537,7 +1537,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device, return rv; } -void notify_resource_state_change(struct sk_buff *skb, +int notify_resource_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_resource_state_change *resource_state_change, enum drbd_notification_type type) @@ -1550,10 +1550,10 @@ void notify_resource_state_change(struct sk_buff *skb, .res_susp_fen = resource_state_change->susp_fen[NEW], }; - notify_resource_state(skb, seq, resource, &resource_info, type); + return notify_resource_state(skb, seq, resource, &resource_info, type); } -void notify_connection_state_change(struct sk_buff *skb, +int notify_connection_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_connection_state_change *connection_state_change, enum drbd_notification_type type) @@ -1564,7 +1564,7 @@ void notify_connection_state_change(struct sk_buff *skb, .conn_role = connection_state_change->peer_role[NEW], }; - notify_connection_state(skb, seq, connection, &connection_info, type); + return notify_connection_state(skb, seq, connection, &connection_info, type); } void notify_device_state_change(struct sk_buff *skb, @@ -1577,10 +1577,10 @@ void notify_device_state_change(struct sk_buff *skb, .dev_disk_state = device_state_change->disk_state[NEW], }; - notify_device_state(skb, seq, device, &device_info, type); + return notify_device_state(skb, seq, device, &device_info, type); } -void notify_peer_device_state_change(struct sk_buff *skb, +int notify_peer_device_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_peer_device_state_change *p, enum drbd_notification_type type) @@ -1594,7 +1594,7 @@ void notify_peer_device_state_change(struct sk_buff *skb, .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], }; - notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); + return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); } static void broadcast_state_change(struct drbd_state_change *state_change) diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h index ba80f612d6ab..d5b0479bc9a6 100644 --- a/drivers/block/drbd/drbd_state_change.h +++ b/drivers/block/drbd/drbd_state_change.h @@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_ extern void copy_old_to_new_state_change(struct drbd_state_change *); extern void forget_state_change(struct drbd_state_change *); -extern void notify_resource_state_change(struct sk_buff *, +extern int notify_resource_state_change(struct sk_buff *, unsigned int, struct drbd_resource_state_change *, enum drbd_notification_type type); -extern void notify_connection_state_change(struct sk_buff *, +extern int notify_connection_state_change(struct sk_buff *, unsigned int, struct drbd_connection_state_change *, enum drbd_notification_type type); -extern void notify_device_state_change(struct sk_buff *, +extern int notify_device_state_change(struct sk_buff *, unsigned int, struct drbd_device_state_change *, enum drbd_notification_type type); -extern void notify_peer_device_state_change(struct sk_buff *, +extern int notify_peer_device_state_change(struct sk_buff *, unsigned int, struct drbd_peer_device_state_change *, enum drbd_notification_type type);
In get_initial_state, it calls notify_initial_state_done(skb,..) if cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(), the skb will be freed by nlmsg_free(skb). Then get_initial_state will goto out and the freed skb will be used by return value skb->len, which is a uaf bug. What's worse, the same problem goes even further: skb can also be freed in the notify_*_state_change -> notify_*_state calls below. Thus 4 additional uaf bugs happened. My patch lets the problem callee functions: notify_initial_state_done and notify_*_state_change return an error code if errors happen. So that the error codes could be propagated and the uaf bugs can be avoid. Fixes: a29728463b254 ("drbd: Backport the "events2" command") Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> --- drivers/block/drbd/drbd_int.h | 8 ++--- drivers/block/drbd/drbd_nl.c | 41 ++++++++++++++++---------- drivers/block/drbd/drbd_state.c | 14 ++++----- drivers/block/drbd/drbd_state_change.h | 8 ++--- 4 files changed, 40 insertions(+), 31 deletions(-)