nbd: fix null-ptr-dereference while accessing 'nbd->config'
authorLi Nan <linan122@huawei.com>
Thu, 16 Nov 2023 16:23:16 +0000 (00:23 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 20 Dec 2023 16:01:56 +0000 (17:01 +0100)
commitc34fa2d16e98ec26251939d9958731ef74d5c493
treec477884c5d4ba59b47337fe85800ad659147d860
parent8c1517344116cc47bdde5fb9b140189e7938a74c
nbd: fix null-ptr-dereference while accessing 'nbd->config'

[ Upstream commit c2da049f419417808466c529999170f5c3ef7d3d ]

Memory reordering may occur in nbd_genl_connect(), causing config_refs
to be set to 1 while nbd->config is still empty. Opening nbd at this
time will cause null-ptr-dereference.

   T1                      T2
   nbd_open
    nbd_get_config_unlocked
                     nbd_genl_connect
                      nbd_alloc_and_init_config
                       //memory reordered
                        refcount_set(&nbd->config_refs, 1)  // 2
     nbd->config
      ->null point
     nbd->config = config  // 1

Fix it by adding smp barrier to guarantee the execution sequence.

Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Link: https://lore.kernel.org/r/20231116162316.1740402-4-linan666@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/block/nbd.c