From: Hou Tao <houtao1@huawei.com> hulk inclusion category: bugfix bugzilla: 55097 CVE: NA ------------------------------------------------- Now there no protection between partition operations (e.g, partition rescan) and delete_partition() in del_gendisk(), so the following scenario is possible: CPU 1 blkdev_ioctl del_gendisk blkdev_reread_part lock bd_mutex drop_partitions check_partition lock lookup_sem // for each partition deletion_partion // for each partition add_partition The newly added partitions, the device files (e.g, /dev/sdXN) and the symlinks in /sys/class/block will be left behind. If the deleted disk is online again, the scan of partition will fail with the following error: sysfs: cannot create duplicate filename '/class/block/sdaN' sdX: pN could not be added: 17 Vanilla kernel tries to fix that by commit c76f48eb5c08 ("block: take bd_mutex around delete_partitions in del_gendisk"), but it introduces dead-lock for nbd/loop/xen-frontblk drivers. These in-tree drivers can be fixed, but there may be other affected block drivers, especially the out-of-tree ones, so fixing it in another way. Two methods are considered. The first is waiting for the end of partition operations in del_gendisk(). It is OK but it needs adding new fields in gendisk (bool & wait_queue_head_t). The second is reusing lookup_sem and GENHD_FL_UP to serialize partition operations and del_gendisk(). Now the latter is chose and here are the details. There are six partition operations: (1) add_partition() in blkpg_ioctl() (2) deletion_partion() in blkpg_ioctl() (3) resize in blkpg_ioctl() (4) partition rescan in __blkdev_reread_part() (5) partition revalidate in bdev_disk_changed() (6) deletion_partion() in del_gendisk() op (1)~(5) already take bd_mutex, so using down_read() to serialize with down_write() in del_gendisk() is OK. op (3) only updates the values in hd_struct, so no lock is needed, because it already increase the ref of hd_struct. lookup_sem is used to prevent a newly-created blocking device inode from associating with a deleting gendisk, and the locking order is: part->bd_mutex -> disk->lookup_sem or whole->bd_mutex -> disk->lookup_sem Now it is also used to serialize the partition operations and the new locking order will be: part->bd_mutex -> whole->bd_mutex -> disk->lookup_sem and it is OK. Signed-off-by: Hou Tao <houtao1@huawei.com> Reviewed-by: Jason Yan <yanaijie@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- block/ioctl.c | 19 ++++++++++++++++++- fs/block_dev.c | 11 ++++++++++- 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/block/ioctl.c b/block/ioctl.c index 899ffd50a7c6b..93939b0cbf03e 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -64,9 +64,16 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user } disk_part_iter_exit(&piter); + down_read(&disk->lookup_sem); + if (!(disk->flags & GENHD_FL_UP)) { + up_read(&disk->lookup_sem); + mutex_unlock(&bdev->bd_mutex); + return -ENXIO; + } /* all seems OK */ part = add_partition(disk, partno, start, length, ADDPART_FLAG_NONE, NULL); + up_read(&disk->lookup_sem); mutex_unlock(&bdev->bd_mutex); return PTR_ERR_OR_ZERO(part); case BLKPG_DEL_PARTITION: @@ -90,7 +97,9 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user invalidate_bdev(bdevp); mutex_lock_nested(&bdev->bd_mutex, 1); + down_read(&disk->lookup_sem); delete_partition(disk, partno); + up_read(&disk->lookup_sem); mutex_unlock(&bdev->bd_mutex); mutex_unlock(&bdevp->bd_mutex); bdput(bdevp); @@ -162,6 +171,7 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user int __blkdev_reread_part(struct block_device *bdev) { struct gendisk *disk = bdev->bd_disk; + int err; if (!disk_part_scan_enabled(disk) || bdev != bdev->bd_contains) return -EINVAL; @@ -170,7 +180,14 @@ int __blkdev_reread_part(struct block_device *bdev) lockdep_assert_held(&bdev->bd_mutex); - return rescan_partitions(disk, bdev); + down_read(&disk->lookup_sem); + if (disk->flags & GENHD_FL_UP) + err = rescan_partitions(disk, bdev); + else + err = -ENXIO; + up_read(&disk->lookup_sem); + + return err; } EXPORT_SYMBOL(__blkdev_reread_part); diff --git a/fs/block_dev.c b/fs/block_dev.c index 77dbfc832bb9f..8b299347f2aa9 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -1499,11 +1499,20 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part); static void bdev_disk_changed(struct block_device *bdev, bool invalidate) { - if (disk_part_scan_enabled(bdev->bd_disk)) { + struct gendisk *disk = bdev->bd_disk; + + if (disk_part_scan_enabled(disk)) { + down_read(&disk->lookup_sem); + if (!(disk->flags & GENHD_FL_UP)) { + up_read(&disk->lookup_sem); + return; + } + if (invalidate) invalidate_partitions(bdev->bd_disk, bdev); else rescan_partitions(bdev->bd_disk, bdev); + up_read(&disk->lookup_sem); } else { check_disk_size_change(bdev->bd_disk, bdev, !invalidate); bdev->bd_invalidated = 0; -- 2.25.1