dm: fix dm_blk_report_zones

If dm_get_live_table() returned NULL, dm_put_live_table() was never
called. Also, it is possible that md->zone_revalidate_map will change
while calling this function. Only read it once, so that we are always
using the same value. Otherwise we might miss a call to
dm_put_live_table().

Finally, while md->zone_revalidate_map is set and a process is calling
blk_revalidate_disk_zones() to set up the zone append emulation
resources, it is possible that another process, perhaps triggered by
blkdev_report_zones_ioctl(), will call dm_blk_report_zones(). If
blk_revalidate_disk_zones() fails, these resources can be freed while
the other process is still using them, causing a use-after-free error.

blk_revalidate_disk_zones() will only ever be called when initially
setting up the zone append emulation resources, such as when setting up
a zoned dm-crypt table for the first time. Further table swaps will not
set md->zone_revalidate_map or call blk_revalidate_disk_zones().
However it must be called using the new table (referenced by
md->zone_revalidate_map) and the new queue limits while the DM device is
suspended. dm_blk_report_zones() needs some way to distinguish between a
call from blk_revalidate_disk_zones(), which must be allowed to use
md->zone_revalidate_map to access this not yet activated table, and all
other calls to dm_blk_report_zones(), which should not be allowed while
the device is suspended and cannot use md->zone_revalidate_map, since
the zone resources might be freed by the process currently calling
blk_revalidate_disk_zones().

Solve this by tracking the process that sets md->zone_revalidate_map in
dm_revalidate_zones() and only allowing that process to make use of it
in dm_blk_report_zones().

Fixes: f211268ed1f9b ("dm: Use the block layer zone append emulation")
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Tested-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
index 3637761f35853ccf86d740c5e3feaf7088613cd7..f3a3f2ef632261e802a0772f99219f76abf8cc0a 100644 (file)
--- a/drivers/md/dm-core.h
+++ b/drivers/md/dm-core.h
@@ -141,6 +141,7 @@ struct mapped_device {
 #ifdef CONFIG_BLK_DEV_ZONED
        unsigned int nr_zones;
        void *zone_revalidate_map;
+       struct task_struct *revalidate_map_task;
 #endif
 
 #ifdef CONFIG_IMA

diff --git a/drivers/md/dm-zone.c b/drivers/md/dm-zone.c
index 681058feb63b5ab718a4f2e10ef101cae7a9a76e..ff9a1a94eea96a60d679d3f59a7e2bf3257edd94 100644 (file)
--- a/drivers/md/dm-zone.c
+++ b/drivers/md/dm-zone.c
@@ -56,24 +56,31 @@ int dm_blk_report_zones(struct gendisk *disk, sector_t sector,
 {
        struct mapped_device *md = disk->private_data;
        struct dm_table *map;
-       int srcu_idx, ret;
+       struct dm_table *zone_revalidate_map = md->zone_revalidate_map;
+       int srcu_idx, ret = -EIO;
+       bool put_table = false;
 
-       if (!md->zone_revalidate_map) {
-               /* Regular user context */
+       if (!zone_revalidate_map || md->revalidate_map_task != current) {
+               /*
+                * Regular user context or
+                * Zone revalidation during __bind() is in progress, but this
+                * call is from a different process
+                */
                if (dm_suspended_md(md))
                        return -EAGAIN;
 
                map = dm_get_live_table(md, &srcu_idx);
-               if (!map)
-                       return -EIO;
+               put_table = true;
        } else {
                /* Zone revalidation during __bind() */
-               map = md->zone_revalidate_map;
+               map = zone_revalidate_map;
        }
 
-       ret = dm_blk_do_report_zones(md, map, sector, nr_zones, cb, data);
+       if (map)
+               ret = dm_blk_do_report_zones(md, map, sector, nr_zones, cb,
+                                            data);
 
-       if (!md->zone_revalidate_map)
+       if (put_table)
                dm_put_live_table(md, srcu_idx);
 
        return ret;
@@ -175,7 +182,9 @@ int dm_revalidate_zones(struct dm_table *t, struct request_queue *q)
         * our table for dm_blk_report_zones() to use directly.
         */
        md->zone_revalidate_map = t;
+       md->revalidate_map_task = current;
        ret = blk_revalidate_disk_zones(disk);
+       md->revalidate_map_task = NULL;
        md->zone_revalidate_map = NULL;
 
        if (ret) {