From patchwork Wed Dec 20 02:46:19 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Wang Zhaolong X-Patchwork-Id: 1878351 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=ely//Hj4; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=patchwork.ozlabs.org) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SvyYm6x5Nz20LT for ; Wed, 20 Dec 2023 13:43:56 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:CC :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=VCOwZmumFEzcnVjvD2CcWMxUdEkQJuDtrGREAyL9jMI=; b=ely//Hj4+jBqrz pEW3fYZxl4/pskeOUNSzdilvIU/Mk1adV81RiKTzSstbsFLbwA5L8KuCeIQQGEGDHADh9f37mmPyA /ifQWQntTKQfrq9yJ+pREGzxiSL59WheK2sUgC2jNfgxBUvqYJcOIdUf/1ji4Gm2jx7I0jBqHwbFT 75NvBmAdn8JAERTtxLNUoyz8sHepZjUcZVzfFnTkl8AVdQyqP9SFI5sMCet67eh9D2FZznairFDIl 5k23SuZUDO2jWpBPeDjQPps8ZiSXECi9ZPiKDBuMFm+cMYrNtMyiMXgd8SO4KCGQf5Xqdm/chBKEU kIkfnGpR9zaoeQrB3OUA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1rFmYE-00FzTL-1q; Wed, 20 Dec 2023 02:43:14 +0000 Received: from szxga04-in.huawei.com ([45.249.212.190]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1rFmY9-00FzSu-0l for linux-mtd@lists.infradead.org; Wed, 20 Dec 2023 02:43:12 +0000 Received: from mail.maildlp.com (unknown [172.19.163.44]) by szxga04-in.huawei.com (SkyGuard) with ESMTP id 4SvyXR18DQz1wnwQ; Wed, 20 Dec 2023 10:42:47 +0800 (CST) Received: from dggpemd200001.china.huawei.com (unknown [7.185.36.224]) by mail.maildlp.com (Postfix) with ESMTPS id 6CE0F140412; Wed, 20 Dec 2023 10:43:01 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpemd200001.china.huawei.com (7.185.36.224) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.1258.28; Wed, 20 Dec 2023 10:43:00 +0800 From: ZhaoLong Wang To: , , , , CC: , , , , , Subject: [PATCH V4] mtd: Fix gluebi NULL pointer dereference caused by ftl notifier Date: Wed, 20 Dec 2023 10:46:19 +0800 Message-ID: <20231220024619.2138625-1-wangzhaolong1@huawei.com> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 X-Originating-IP: [10.175.127.227] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To dggpemd200001.china.huawei.com (7.185.36.224) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20231219_184309_467381_056FBF66 X-CRM114-Status: GOOD ( 12.12 ) X-Spam-Score: -2.3 (--) X-Spam-Report: =?unknown-8bit?q?Spam_detection_software=2C_running_on_the_sy?= =?unknown-8bit?q?stem_=22bombadil=2Einfradead=2Eorg=22=2C?= =?unknown-8bit?q?_has_NOT_identified_this_incoming_email_as_spam=2E__The_ori?= =?unknown-8bit?q?ginal?= =?unknown-8bit?q?_message_has_been_attached_to_this_so_you_can_view_it_or_la?= =?unknown-8bit?q?bel?= =?unknown-8bit?q?_similar_future_email=2E__If_you_have_any_questions=2C_see?= =?unknown-8bit?q?_the_administrator_of_that_system_for_details=2E?= =?unknown-8bit?q?_?= =?unknown-8bit?q?_Content_preview=3A__If_both_ftl=2Eko_and_gluebi=2Eko_are_l?= =?unknown-8bit?q?oaded=2C_the_notifier_of_ftl?= =?unknown-8bit?q?_triggers_NULL_pointer_dereference_when_trying_to_access_?= =?unknown-8bit?q?=E2=80=98gluebi-=3Edesc=E2=80=99?= =?unknown-8bit?q?_in_gluebi=5Fread=28=29=2E_ubi=5Fgluebi=5Finit_ubi=5Fregist?= =?unknown-8bit?q?er=5Fvolume=5Fnotifier_ubi=5Fenumerate=5Fvolumes?= =?unknown-8bit?q?_ubi=5Fnotify=5Fall_gluebi=5Fnotify_nb-=3Enotifier=5Fcall?= =?unknown-8bit?q?=28=29_gluebi=5Fcreate_mtd=5Fdevice=5Fregister?= =?unknown-8bit?q?_mtd=5Fdevice=5Fparse=5Fregister_add=5Fmtd=5Fdevice_blktran?= =?unknown-8bit?q?s=5F_=5B=2E=2E=2E=5D_?= =?unknown-8bit?q?_?= =?unknown-8bit?q?_Content_analysis_details=3A___=28-2=2E3_points=2C_5=2E0_re?= =?unknown-8bit?q?quired=29?= =?unknown-8bit?q?_?= =?unknown-8bit?q?_pts_rule_name______________description?= =?unknown-8bit?q?_----_----------------------_------------------------------?= =?unknown-8bit?q?--------------------?= =?unknown-8bit?q?_-0=2E0_SPF=5FPASS_______________SPF=3A_sender_matches_SPF_?= =?unknown-8bit?q?record?= =?unknown-8bit?q?_-2=2E3_RCVD=5FIN=5FDNSWL=5FMED______RBL=3A_Sender_listed_a?= =?unknown-8bit?q?t_https=3A//www=2Ednswl=2Eorg/=2C?= =?unknown-8bit?q?_medium_trust?= =?unknown-8bit?q?_=5B45=2E249=2E212=2E190_listed_in_list=2Ednswl=2Eorg=5D?= =?unknown-8bit?q?_0=2E0_RCVD=5FIN=5FMSPIKE=5FH4______RBL=3A_Very_Good_reputa?= =?unknown-8bit?q?tion_=28+4=29?= =?unknown-8bit?q?_=5B45=2E249=2E212=2E190_listed_in_wl=2Emailspike=2Enet=5D?= =?unknown-8bit?q?_0=2E0_SPF=5FHELO=5FNONE__________SPF=3A_HELO_does_not_publ?= =?unknown-8bit?q?ish_an_SPF_Record?= =?unknown-8bit?q?_0=2E0_RCVD=5FIN=5FMSPIKE=5FWL______Mailspike_good_senders?= X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-mtd" Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME. Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1] Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@nod.at/ [2] Signed-off-by: ZhaoLong Wang Reviewed-by: Zhihao Cheng Acked-by: Richard Weinberger --- drivers/mtd/mtd_blkdevs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index ff18636e0889..5bc32108ca03 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -463,7 +463,7 @@ static void blktrans_notify_add(struct mtd_info *mtd) { struct mtd_blktrans_ops *tr; - if (mtd->type == MTD_ABSENT) + if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME) return; list_for_each_entry(tr, &blktrans_majors, list) @@ -503,7 +503,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr) mutex_lock(&mtd_table_mutex); list_add(&tr->list, &blktrans_majors); mtd_for_each_device(mtd) - if (mtd->type != MTD_ABSENT) + if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME) tr->add_mtd(tr, mtd); mutex_unlock(&mtd_table_mutex); return 0;