block: partition: initialize percpuref before sending out KOBJ_ADD (b30a337c) · Commits · 戴 / test

The initialization of partition's percpu_ref should have been done before sending out KOBJ_ADD uevent, which may cause userspace to read partition table. So the uninitialized percpu_ref may be accessed in data path. This patch fixes this issue reported by Naveen. Reported-by:

Naveen Kaje <nkaje@codeaurora.org> Tested-by:

Naveen Kaje <nkaje@codeaurora.org> Fixes: (block: partition: convert percpu ref) Cc: <stable@vger.kernel.org> # v4.3+ Signed-off-by:

Ming Lei <ming.lei@canonical.com> Signed-off-by:

Jens Axboe <axboe@fb.com>

block/partition-generic.c

+10 −3

Original line number	Diff line number	Diff line
		@@ -361,14 +361,19 @@ struct hd_struct add_partition(struct gendisk disk, int partno,
		goto out_del;
		}

		err = hd_ref_init(p);
		if (err) {
		if (flags & ADDPART_FLAG_WHOLEDISK)
		goto out_remove_file;
		goto out_del;
		}

		/* everything is up and running, commence */
		rcu_assign_pointer(ptbl->part[partno], p);

		/* suppress uevent if the disk suppresses it */
		if (!dev_get_uevent_suppress(ddev))
		kobject_uevent(&pdev->kobj, KOBJ_ADD);

		if (!hd_ref_init(p))
		return p;

		out_free_info:
		@@ -378,6 +383,8 @@ out_free_stats:
		out_free:
		kfree(p);
		return ERR_PTR(err);
		out_remove_file:
		device_remove_file(pdev, &dev_attr_whole_disk);
		out_del:
		kobject_put(p->holder_dir);
		device_del(pdev);

Admin message