Zheng Qixing 91fa560c73 nbd: fix uaf in nbd_genl_connect() error path ... [ Upstream commit aa9552438e ] There is a use-after-free issue in nbd: block nbd6: Receive control failed (result -104) block nbd6: shutting down sockets ================================================================== BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022 Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67 CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: nbd6-recv recv_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline] recv_work+0x694/0xa80 drivers/block/nbd.c:1022 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> nbd_genl_connect() does not properly stop the device on certain error paths after nbd_start_device() has been called. This causes the error path to put nbd->config while recv_work continue to use the config after putting it, leading to use-after-free in recv_work. This patch moves nbd_start_device() after the backend file creation. Reported-by: syzbot+48240bab47e705c53126@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68227a04.050a0220.f2294.00b5.GAE@google.com/T/ Fixes: 6497ef8df5 ("nbd: provide a way for userspace processes to identify device backends") Signed-off-by: Zheng Qixing <zhengqixing@huawei.com> Reviewed-by: Yu Kuai <yukuai3@huawei.com> Link: https://lore.kernel.org/r/20250612132405.364904-1-zhengqixing@huaweicloud.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-07-17 18:32:11 +02:00
..
aoe	aoe: defer rexmit timer downdev work to workqueue	2025-07-10 15:59:50 +02:00
drbd	drbd: Add NULL check for net_conf to prevent dereference in state validation	2024-10-17 15:21:21 +02:00
mtip32xx
null_blk	null_blk: Fix return value of nullb_device_power_store()	2024-11-22 15:37:35 +01:00
paride
rnbd
xen-blkback
zram	zram: fix potential UAF of zram table	2025-01-23 17:17:13 +01:00
amiflop.c
ataflop.c
brd.c	brd: defer automatic disk creation until module initialization succeeds	2024-12-14 19:53:14 +01:00
floppy.c
Kconfig
loop.c	loop: aio inherit the ioprio of original request	2025-05-02 07:47:07 +02:00
Makefile
n64cart.c
nbd.c	nbd: fix uaf in nbd_genl_connect() error path	2025-07-17 18:32:11 +02:00
pktcdvd.c
ps3disk.c
ps3vram.c
rbd_types.h
rbd.c
sunvdc.c
swim_asm.S
swim.c
swim3.c
ublk_drv.c	ublk: set_params: properly check if parameters can be applied	2025-03-13 12:53:18 +01:00
virtio_blk.c	virtio-blk: don't keep queue frozen during system suspend	2025-01-02 10:30:52 +01:00
xen-blkfront.c
z2ram.c