rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
authorIlya Dryomov <idryomov@gmail.com>
Fri, 24 Feb 2023 17:48:54 +0000 (18:48 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 10 Mar 2023 08:34:25 +0000 (09:34 +0100)
commitfaa7b683e436664fff5648426950718277831348
tree967c63d7ece5006c82633ab047a9fc275f255a0b
parentbea92c2d45a5c20e879ba9d7d90e6bf554d6123f
rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails

commit f7c4d9b133c7a04ca619355574e96b6abf209fba upstream.

If getting an ID or setting up a work queue in rbd_dev_create() fails,
use-after-free on rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts
is triggered in do_rbd_add().  The root cause is that the ownership of
these structures is transfered to rbd_dev prematurely and they all end
up getting freed when rbd_dev_create() calls rbd_dev_free() prior to
returning to do_rbd_add().

Found by Linux Verification Center (linuxtesting.org) with SVACE, an
incomplete patch submitted by Natalia Petrova <n.petrova@fintech.ru>.

Cc: stable@vger.kernel.org
Fixes: 1643dfa4c2c8 ("rbd: introduce a per-device ordered workqueue")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/block/rbd.c