mirror of
https://github.com/torvalds/linux.git
synced 2026-03-07 23:04:33 +01:00
nvme_pr_read_keys() takes num_keys from userspace and uses it to
calculate the allocation size for rse via struct_size(). The upper
limit is PR_KEYS_MAX (64K).
A malicious or buggy userspace can pass a large num_keys value that
results in a 4MB allocation attempt at most, causing a warning in
the page allocator when the order exceeds MAX_PAGE_ORDER.
To fix this, use kvzalloc() instead of kzalloc().
This bug has the same reasoning and fix with the patch below:
https://lore.kernel.org/linux-block/20251212013510.3576091-1-kartikey406@gmail.com/
Warning log:
WARNING: mm/page_alloc.c:5216 at __alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216, CPU#1: syz-executor117/272
Modules linked in:
CPU: 1 UID: 0 PID: 272 Comm: syz-executor117 Not tainted 6.19.0 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
RIP: 0010:__alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216
Code: ff 83 bd a8 fe ff ff 0a 0f 86 69 fb ff ff 0f b6 1d f9 f9 c4 04 80 fb 01 0f 87 3b 76 30 ff 83 e3 01 75 09 c6 05 e4 f9 c4 04 01 <0f> 0b 48 c7 85 70 fe ff ff 00 00 00 00 e9 8f fd ff ff 31 c0 e9 0d
RSP: 0018:ffffc90000fcf450 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffff920001f9ea0
RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000040dc0
RBP: ffffc90000fcf648 R08: ffff88800b6c3380 R09: 0000000000000001
R10: ffffc90000fcf840 R11: ffff88807ffad280 R12: 0000000000000000
R13: 0000000000040dc0 R14: 0000000000000001 R15: ffffc90000fcf620
FS: 0000555565db33c0(0000) GS:ffff8880be26c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002000000c CR3: 0000000003b72000 CR4: 00000000000006f0
Call Trace:
<TASK>
alloc_pages_mpol+0x236/0x4d0 mm/mempolicy.c:2486
alloc_frozen_pages_noprof+0x149/0x180 mm/mempolicy.c:2557
___kmalloc_large_node+0x10c/0x140 mm/slub.c:5598
__kmalloc_large_node_noprof+0x25/0xc0 mm/slub.c:5629
__do_kmalloc_node mm/slub.c:5645 [inline]
__kmalloc_noprof+0x483/0x6f0 mm/slub.c:5669
kmalloc_noprof include/linux/slab.h:961 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
nvme_pr_read_keys+0x8f/0x4c0 drivers/nvme/host/pr.c:245
blkdev_pr_read_keys block/ioctl.c:456 [inline]
blkdev_common_ioctl+0x1b71/0x29b0 block/ioctl.c:730
blkdev_ioctl+0x299/0x700 block/ioctl.c:786
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x1bf/0x220 fs/ioctl.c:583
x64_sys_call+0x1280/0x21b0 mnt/fuzznvme_1/fuzznvme/linux-build/v6.19/./arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x71/0x330 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fb893d3108d
Code: 28 c3 e8 46 1e 00 00 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffff61f2f38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffff61f3138 RCX: 00007fb893d3108d
RDX: 0000000020000040 RSI: 00000000c01070ce RDI: 0000000000000003
RBP: 0000000000000001 R08: 0000000000000000 R09: 00007ffff61f3138
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffff61f3128 R14: 00007fb893dae530 R15: 0000000000000001
</TASK>
Fixes: 5fd96a4e15 (nvme: Add pr_ops read_keys support)
Acked-by: Chao Shi <cshi008@fiu.edu>
Acked-by: Weidong Zhu <weizhu@fiu.edu>
Acked-by: Dave Tian <daveti@purdue.edu>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
Signed-off-by: Keith Busch <kbusch@kernel.org>
344 lines
8.4 KiB
C
344 lines
8.4 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Copyright (c) 2015 Intel Corporation
|
|
* Keith Busch <kbusch@kernel.org>
|
|
*/
|
|
#include <linux/blkdev.h>
|
|
#include <linux/pr.h>
|
|
#include <linux/unaligned.h>
|
|
|
|
#include "nvme.h"
|
|
|
|
static enum nvme_pr_type nvme_pr_type_from_blk(enum pr_type type)
|
|
{
|
|
switch (type) {
|
|
case PR_WRITE_EXCLUSIVE:
|
|
return NVME_PR_WRITE_EXCLUSIVE;
|
|
case PR_EXCLUSIVE_ACCESS:
|
|
return NVME_PR_EXCLUSIVE_ACCESS;
|
|
case PR_WRITE_EXCLUSIVE_REG_ONLY:
|
|
return NVME_PR_WRITE_EXCLUSIVE_REG_ONLY;
|
|
case PR_EXCLUSIVE_ACCESS_REG_ONLY:
|
|
return NVME_PR_EXCLUSIVE_ACCESS_REG_ONLY;
|
|
case PR_WRITE_EXCLUSIVE_ALL_REGS:
|
|
return NVME_PR_WRITE_EXCLUSIVE_ALL_REGS;
|
|
case PR_EXCLUSIVE_ACCESS_ALL_REGS:
|
|
return NVME_PR_EXCLUSIVE_ACCESS_ALL_REGS;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static enum pr_type block_pr_type_from_nvme(enum nvme_pr_type type)
|
|
{
|
|
switch (type) {
|
|
case NVME_PR_WRITE_EXCLUSIVE:
|
|
return PR_WRITE_EXCLUSIVE;
|
|
case NVME_PR_EXCLUSIVE_ACCESS:
|
|
return PR_EXCLUSIVE_ACCESS;
|
|
case NVME_PR_WRITE_EXCLUSIVE_REG_ONLY:
|
|
return PR_WRITE_EXCLUSIVE_REG_ONLY;
|
|
case NVME_PR_EXCLUSIVE_ACCESS_REG_ONLY:
|
|
return PR_EXCLUSIVE_ACCESS_REG_ONLY;
|
|
case NVME_PR_WRITE_EXCLUSIVE_ALL_REGS:
|
|
return PR_WRITE_EXCLUSIVE_ALL_REGS;
|
|
case NVME_PR_EXCLUSIVE_ACCESS_ALL_REGS:
|
|
return PR_EXCLUSIVE_ACCESS_ALL_REGS;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int nvme_send_ns_head_pr_command(struct block_device *bdev,
|
|
struct nvme_command *c, void *data, unsigned int data_len)
|
|
{
|
|
struct nvme_ns_head *head = bdev->bd_disk->private_data;
|
|
int srcu_idx = srcu_read_lock(&head->srcu);
|
|
struct nvme_ns *ns = nvme_find_path(head);
|
|
int ret = -EWOULDBLOCK;
|
|
|
|
if (ns) {
|
|
c->common.nsid = cpu_to_le32(ns->head->ns_id);
|
|
ret = nvme_submit_sync_cmd(ns->queue, c, data, data_len);
|
|
}
|
|
srcu_read_unlock(&head->srcu, srcu_idx);
|
|
return ret;
|
|
}
|
|
|
|
static int nvme_send_ns_pr_command(struct nvme_ns *ns, struct nvme_command *c,
|
|
void *data, unsigned int data_len)
|
|
{
|
|
c->common.nsid = cpu_to_le32(ns->head->ns_id);
|
|
return nvme_submit_sync_cmd(ns->queue, c, data, data_len);
|
|
}
|
|
|
|
static int nvme_status_to_pr_err(int status)
|
|
{
|
|
if (nvme_is_path_error(status))
|
|
return PR_STS_PATH_FAILED;
|
|
|
|
switch (status & NVME_SCT_SC_MASK) {
|
|
case NVME_SC_SUCCESS:
|
|
return PR_STS_SUCCESS;
|
|
case NVME_SC_RESERVATION_CONFLICT:
|
|
return PR_STS_RESERVATION_CONFLICT;
|
|
case NVME_SC_BAD_ATTRIBUTES:
|
|
case NVME_SC_INVALID_OPCODE:
|
|
case NVME_SC_INVALID_FIELD:
|
|
case NVME_SC_INVALID_NS:
|
|
return -EINVAL;
|
|
default:
|
|
return PR_STS_IOERR;
|
|
}
|
|
}
|
|
|
|
static int __nvme_send_pr_command(struct block_device *bdev, u32 cdw10,
|
|
u32 cdw11, u8 op, void *data, unsigned int data_len)
|
|
{
|
|
struct nvme_command c = { 0 };
|
|
|
|
c.common.opcode = op;
|
|
c.common.cdw10 = cpu_to_le32(cdw10);
|
|
c.common.cdw11 = cpu_to_le32(cdw11);
|
|
|
|
if (nvme_disk_is_ns_head(bdev->bd_disk))
|
|
return nvme_send_ns_head_pr_command(bdev, &c, data, data_len);
|
|
return nvme_send_ns_pr_command(bdev->bd_disk->private_data, &c,
|
|
data, data_len);
|
|
}
|
|
|
|
static int nvme_send_pr_command(struct block_device *bdev, u32 cdw10, u32 cdw11,
|
|
u8 op, void *data, unsigned int data_len)
|
|
{
|
|
int ret;
|
|
|
|
ret = __nvme_send_pr_command(bdev, cdw10, cdw11, op, data, data_len);
|
|
return ret < 0 ? ret : nvme_status_to_pr_err(ret);
|
|
}
|
|
|
|
static int nvme_pr_register(struct block_device *bdev, u64 old_key, u64 new_key,
|
|
unsigned int flags)
|
|
{
|
|
struct nvmet_pr_register_data data = { 0 };
|
|
u32 cdw10;
|
|
|
|
if (flags & ~PR_FL_IGNORE_KEY)
|
|
return -EOPNOTSUPP;
|
|
|
|
data.crkey = cpu_to_le64(old_key);
|
|
data.nrkey = cpu_to_le64(new_key);
|
|
|
|
cdw10 = old_key ? NVME_PR_REGISTER_ACT_REPLACE :
|
|
NVME_PR_REGISTER_ACT_REG;
|
|
cdw10 |= (flags & PR_FL_IGNORE_KEY) ? NVME_PR_IGNORE_KEY : 0;
|
|
cdw10 |= NVME_PR_CPTPL_PERSIST;
|
|
|
|
return nvme_send_pr_command(bdev, cdw10, 0, nvme_cmd_resv_register,
|
|
&data, sizeof(data));
|
|
}
|
|
|
|
static int nvme_pr_reserve(struct block_device *bdev, u64 key,
|
|
enum pr_type type, unsigned flags)
|
|
{
|
|
struct nvmet_pr_acquire_data data = { 0 };
|
|
u32 cdw10;
|
|
|
|
if (flags & ~PR_FL_IGNORE_KEY)
|
|
return -EOPNOTSUPP;
|
|
|
|
data.crkey = cpu_to_le64(key);
|
|
|
|
cdw10 = NVME_PR_ACQUIRE_ACT_ACQUIRE;
|
|
cdw10 |= nvme_pr_type_from_blk(type) << 8;
|
|
cdw10 |= (flags & PR_FL_IGNORE_KEY) ? NVME_PR_IGNORE_KEY : 0;
|
|
|
|
return nvme_send_pr_command(bdev, cdw10, 0, nvme_cmd_resv_acquire,
|
|
&data, sizeof(data));
|
|
}
|
|
|
|
static int nvme_pr_preempt(struct block_device *bdev, u64 old, u64 new,
|
|
enum pr_type type, bool abort)
|
|
{
|
|
struct nvmet_pr_acquire_data data = { 0 };
|
|
u32 cdw10;
|
|
|
|
data.crkey = cpu_to_le64(old);
|
|
data.prkey = cpu_to_le64(new);
|
|
|
|
cdw10 = abort ? NVME_PR_ACQUIRE_ACT_PREEMPT_AND_ABORT :
|
|
NVME_PR_ACQUIRE_ACT_PREEMPT;
|
|
cdw10 |= nvme_pr_type_from_blk(type) << 8;
|
|
|
|
return nvme_send_pr_command(bdev, cdw10, 0, nvme_cmd_resv_acquire,
|
|
&data, sizeof(data));
|
|
}
|
|
|
|
static int nvme_pr_clear(struct block_device *bdev, u64 key)
|
|
{
|
|
struct nvmet_pr_release_data data = { 0 };
|
|
u32 cdw10;
|
|
|
|
data.crkey = cpu_to_le64(key);
|
|
|
|
cdw10 = NVME_PR_RELEASE_ACT_CLEAR;
|
|
cdw10 |= key ? 0 : NVME_PR_IGNORE_KEY;
|
|
|
|
return nvme_send_pr_command(bdev, cdw10, 0, nvme_cmd_resv_release,
|
|
&data, sizeof(data));
|
|
}
|
|
|
|
static int nvme_pr_release(struct block_device *bdev, u64 key, enum pr_type type)
|
|
{
|
|
struct nvmet_pr_release_data data = { 0 };
|
|
u32 cdw10;
|
|
|
|
data.crkey = cpu_to_le64(key);
|
|
|
|
cdw10 = NVME_PR_RELEASE_ACT_RELEASE;
|
|
cdw10 |= nvme_pr_type_from_blk(type) << 8;
|
|
cdw10 |= key ? 0 : NVME_PR_IGNORE_KEY;
|
|
|
|
return nvme_send_pr_command(bdev, cdw10, 0, nvme_cmd_resv_release,
|
|
&data, sizeof(data));
|
|
}
|
|
|
|
static int nvme_pr_resv_report(struct block_device *bdev, void *data,
|
|
u32 data_len, bool *eds)
|
|
{
|
|
u32 cdw10, cdw11;
|
|
int ret;
|
|
|
|
cdw10 = nvme_bytes_to_numd(data_len);
|
|
cdw11 = NVME_EXTENDED_DATA_STRUCT;
|
|
*eds = true;
|
|
|
|
retry:
|
|
ret = __nvme_send_pr_command(bdev, cdw10, cdw11, nvme_cmd_resv_report,
|
|
data, data_len);
|
|
if (ret == NVME_SC_HOST_ID_INCONSIST &&
|
|
cdw11 == NVME_EXTENDED_DATA_STRUCT) {
|
|
cdw11 = 0;
|
|
*eds = false;
|
|
goto retry;
|
|
}
|
|
|
|
return ret < 0 ? ret : nvme_status_to_pr_err(ret);
|
|
}
|
|
|
|
static int nvme_pr_read_keys(struct block_device *bdev,
|
|
struct pr_keys *keys_info)
|
|
{
|
|
size_t rse_len;
|
|
u32 num_keys = keys_info->num_keys;
|
|
struct nvme_reservation_status_ext *rse;
|
|
int ret, i;
|
|
bool eds;
|
|
|
|
/*
|
|
* Assume we are using 128-bit host IDs and allocate a buffer large
|
|
* enough to get enough keys to fill the return keys buffer.
|
|
*/
|
|
rse_len = struct_size(rse, regctl_eds, num_keys);
|
|
if (rse_len > U32_MAX)
|
|
return -EINVAL;
|
|
|
|
rse = kvzalloc(rse_len, GFP_KERNEL);
|
|
if (!rse)
|
|
return -ENOMEM;
|
|
|
|
ret = nvme_pr_resv_report(bdev, rse, rse_len, &eds);
|
|
if (ret)
|
|
goto free_rse;
|
|
|
|
keys_info->generation = le32_to_cpu(rse->gen);
|
|
keys_info->num_keys = get_unaligned_le16(&rse->regctl);
|
|
|
|
num_keys = min(num_keys, keys_info->num_keys);
|
|
for (i = 0; i < num_keys; i++) {
|
|
if (eds) {
|
|
keys_info->keys[i] =
|
|
le64_to_cpu(rse->regctl_eds[i].rkey);
|
|
} else {
|
|
struct nvme_reservation_status *rs;
|
|
|
|
rs = (struct nvme_reservation_status *)rse;
|
|
keys_info->keys[i] = le64_to_cpu(rs->regctl_ds[i].rkey);
|
|
}
|
|
}
|
|
|
|
free_rse:
|
|
kvfree(rse);
|
|
return ret;
|
|
}
|
|
|
|
static int nvme_pr_read_reservation(struct block_device *bdev,
|
|
struct pr_held_reservation *resv)
|
|
{
|
|
struct nvme_reservation_status_ext tmp_rse, *rse;
|
|
int ret, i, num_regs;
|
|
u32 rse_len;
|
|
bool eds;
|
|
|
|
get_num_regs:
|
|
/*
|
|
* Get the number of registrations so we know how big to allocate
|
|
* the response buffer.
|
|
*/
|
|
ret = nvme_pr_resv_report(bdev, &tmp_rse, sizeof(tmp_rse), &eds);
|
|
if (ret)
|
|
return ret;
|
|
|
|
num_regs = get_unaligned_le16(&tmp_rse.regctl);
|
|
if (!num_regs) {
|
|
resv->generation = le32_to_cpu(tmp_rse.gen);
|
|
return 0;
|
|
}
|
|
|
|
rse_len = struct_size(rse, regctl_eds, num_regs);
|
|
rse = kzalloc(rse_len, GFP_KERNEL);
|
|
if (!rse)
|
|
return -ENOMEM;
|
|
|
|
ret = nvme_pr_resv_report(bdev, rse, rse_len, &eds);
|
|
if (ret)
|
|
goto free_rse;
|
|
|
|
if (num_regs != get_unaligned_le16(&rse->regctl)) {
|
|
kfree(rse);
|
|
goto get_num_regs;
|
|
}
|
|
|
|
resv->generation = le32_to_cpu(rse->gen);
|
|
resv->type = block_pr_type_from_nvme(rse->rtype);
|
|
|
|
for (i = 0; i < num_regs; i++) {
|
|
if (eds) {
|
|
if (rse->regctl_eds[i].rcsts) {
|
|
resv->key = le64_to_cpu(rse->regctl_eds[i].rkey);
|
|
break;
|
|
}
|
|
} else {
|
|
struct nvme_reservation_status *rs;
|
|
|
|
rs = (struct nvme_reservation_status *)rse;
|
|
if (rs->regctl_ds[i].rcsts) {
|
|
resv->key = le64_to_cpu(rs->regctl_ds[i].rkey);
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
free_rse:
|
|
kfree(rse);
|
|
return ret;
|
|
}
|
|
|
|
const struct pr_ops nvme_pr_ops = {
|
|
.pr_register = nvme_pr_register,
|
|
.pr_reserve = nvme_pr_reserve,
|
|
.pr_release = nvme_pr_release,
|
|
.pr_preempt = nvme_pr_preempt,
|
|
.pr_clear = nvme_pr_clear,
|
|
.pr_read_keys = nvme_pr_read_keys,
|
|
.pr_read_reservation = nvme_pr_read_reservation,
|
|
};
|