null_blk: fix init/exit races, leaks and cleanup - #1039
Open
blktests-ci[bot] wants to merge 6 commits into
Open
Conversation
Author
|
Upstream branch: 8cdeaa5 |
Author
|
Upstream branch: 8cdeaa5 |
blktests-ci
Bot
force-pushed
the
series/1122757=>linus-master
branch
from
July 7, 2026 04:25
c094b3b to
ff1b28d
Compare
Author
|
Upstream branch: 8cdeaa5 |
blktests-ci
Bot
force-pushed
the
series/1122757=>linus-master
branch
from
July 7, 2026 05:07
ff1b28d to
6fd3bc5
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
July 7, 2026 08:33
a644c13 to
a2204c3
Compare
Author
|
Upstream branch: 0e35b9b |
blktests-ci
Bot
force-pushed
the
series/1122757=>linus-master
branch
from
July 7, 2026 08:43
6fd3bc5 to
d7e6cb8
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
August 2, 2026 08:05
a2204c3 to
c0cc428
Compare
In null_init(), mutex_init(&lock) currently happens after configfs_register_subsystem(), which exposes the nullb subsystem to userspace. A racing mkdir() into /sys/kernel/config/nullb/ can reach null_find_dev_by_name() -> mutex_lock(&lock) before the mutex is initialized, trigger warning: [ 123.137788] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 123.137796] WARNING: kernel/locking/mutex.c:159 at mutex_lock+0x171/0x1c0, CPU#13: mkdir/1301 [ 123.140090] Modules linked in: null_blk(+) nft_fib_inet nft_fib_ipv4 ...... [ 123.154926] Call Trace: [ 123.155172] <TASK> [ 123.155419] ? __pfx_mutex_lock+0x10/0x10 [ 123.156181] ? __pfx__raw_spin_lock+0x10/0x10 [ 123.156571] nullb_group_make_group+0x20/0x100 [null_blk] [ 123.157011] configfs_mkdir+0x47b/0xc70 [ 123.157337] ? __pfx_configfs_mkdir+0x10/0x10 [ 123.157719] ? may_create_dentry+0x242/0x2e0 [ 123.158061] vfs_mkdir+0x2a9/0x6c0 [ 123.158352] filename_mkdirat+0x3dc/0x500 [ 123.158710] ? __pfx_filename_mkdirat+0x10/0x10 [ 123.159070] ? strncpy_from_user+0x3a/0x1d0 [ 123.159413] __x64_sys_mkdir+0x6b/0x90 [ 123.159760] do_syscall_64+0xea/0x600 Replace the runtime mutex_init(&lock) with a static DEFINE_MUTEX(lock) declaration to fix this issue. Fixes: 49c3b92 ("block: null_blk: Improve device creation with configfs") Suggested-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Zizhi Wo <wozizhi@huawei.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
The file-scope lock mutex serializes access to global null_blk state, including the nullb_list and device creation/removal. Rename it to "nullb_global_lock" to make its purpose clear. No functional change. Suggested-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Zizhi Wo <wozizhi@huawei.com>
In null_init(), configfs_register_subsystem() currently runs before register_blkdev(), so when null_blk is built as a module, a racing mkdir() + poweron from userspace can reach null_add_dev() while null_major is still 0. __add_disk() then hits WARN_ON(disk->minors) (major=0 with minors!=0) and fails: [root@fedora ~]# [ 2366.521436] WARNING: block/genhd.c:476 at __add_disk+0x8a7/0xde0, [ 2366.523552] Modules linked in: null_blk(+) nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib [ 2366.529081] CPU: 26 UID: 0 PID: 1600 Comm: sh Not tainted 7.2.0-rc1+ #66 PREEMPT(full) ...... [ 2366.547251] Call Trace: [ 2366.547575] <TASK> [ 2366.547831] ? _raw_spin_lock+0x84/0xe0 [ 2366.548260] add_disk_fwnode+0x114/0x560 [ 2366.548739] null_add_dev+0x102d/0x1b80 [null_blk] [ 2366.549310] ? __pfx_null_add_dev+0x10/0x10 [null_blk] [ 2366.549906] ? mutex_lock+0xde/0x1c0 [ 2366.550361] ? __pfx_mutex_lock+0x10/0x10 [ 2366.550827] nullb_device_power_store+0x1e7/0x280 [null_blk] [ 2366.551499] ? __pfx_nullb_device_power_store+0x10/0x10 [null_blk] [ 2366.552177] ? __kmalloc_cache_noprof+0x1f5/0x470 [ 2366.552748] ? configfs_write_iter+0x35c/0x4e0 [ 2366.553242] configfs_write_iter+0x286/0x4e0 [ 2366.553787] vfs_write+0x52d/0xd00 [ 2366.554169] ? __pfx_vfs_write+0x10/0x10 [ 2366.554679] ? __pfx___css_rstat_updated+0x10/0x10 [ 2366.555196] ? fdget_pos+0x1cf/0x4c0 [ 2366.555649] ksys_write+0xfc/0x1d0 ...... Additionally, the err_dev path destroys all devices on nullb_list while configfs is still registered. If a racing mkdir() + poweron puts a user device on the list, null_destroy_dev()->null_free_dev() kfrees the user device's nullb_device but /sys/kernel/config/nullb/<name> is still reachable. Any userspace access to the item will trigger a UAF. For simplicity, move configfs_register_subsystem() to the end to solve the problems above. This also mirrors null_exit(). Fixes: 3bf2bd2 ("nullb: add configfs interface") Signed-off-by: Zizhi Wo <wozizhi@huawei.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
In null_exit(), unregister_blkdev() was called before the null_blk instances were destroyed, which is inconsistent with the cleanup order in null_init(). Move it after null_destroy_dev() so that teardown happens in the reverse order of initialization. No functional change intended. Suggested-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Zizhi Wo <wozizhi@huaweicloud.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
The NULLB_DEVICE_ATTR macro unconditionally writes dev->NAME = new_value after apply_fn() returns. For attributes with an apply_fn (submit_queues, poll_queues), apply_fn already sets dev->NAME under &nullb_list_lock. configfs serializes writes via a per-open-file mutex (buffer->mutex), so two threads writing to the same attribute through separate open file descriptions run the store callback concurrently. The macro's write is redundant and lockless, so a concurrent store's losing thread can overwrite the winner's value after apply_fn set it, making dev->submit_queues mismatch the hardware state. null_map_queues() then hits a WARN_ON_ONCE and falls back to a single queue. Restructure the macro so that apply_fn attributes return directly after apply_fn, and only non-apply_fn attributes write dev->NAME -- those are only changeable while not CONFIGURED and have no live hardware state to mismatch. Fixes: 45919fb ("null_blk: Enable modifying 'submit_queues' after an instance has been configured") Signed-off-by: Zizhi Wo <wozizhi@huawei.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
If shared_tags is enabled, null_setup_tagset() allocates the global tag_set via null_init_global_tag_set(). If device creation later fails, err_dev destroys the default devices and calls unregister_blkdev(), but never frees the global tag_set. Since module init failed, null_exit() is never invoked, so the global tag_set's tags and maps are permanently leaked. Free the global tag_set in err_dev, matching null_exit() which does if (tag_set.ops) blk_mq_free_tag_set(&tag_set). Fixes: 82f402f ("null_blk: add support for shared tags") Signed-off-by: Zizhi Wo <wozizhi@huawei.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Author
|
Upstream branch: 2d2338c |
blktests-ci
Bot
force-pushed
the
series/1122757=>linus-master
branch
from
August 2, 2026 08:45
d7e6cb8 to
903613a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request for series with
subject: null_blk: fix init/exit races, leaks and cleanup
version: 2
url: https://patchwork.kernel.org/project/linux-block/list/?series=1122757