Patch "nbd: fix null-ptr-dereference while accessing 'nbd->config'" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    nbd: fix null-ptr-dereference while accessing 'nbd->config'

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     nbd-fix-null-ptr-dereference-while-accessing-nbd-con.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 4db06087adc14fc343ce5e5827fcb70d34fc45a0
Author: Li Nan <linan122@xxxxxxxxxx>
Date:   Fri Nov 17 00:23:16 2023 +0800

    nbd: fix null-ptr-dereference while accessing 'nbd->config'
    
    [ Upstream commit c2da049f419417808466c529999170f5c3ef7d3d ]
    
    Memory reordering may occur in nbd_genl_connect(), causing config_refs
    to be set to 1 while nbd->config is still empty. Opening nbd at this
    time will cause null-ptr-dereference.
    
       T1                      T2
       nbd_open
        nbd_get_config_unlocked
                               nbd_genl_connect
                                nbd_alloc_and_init_config
                                 //memory reordered
                                 refcount_set(&nbd->config_refs, 1)  // 2
         nbd->config
          ->null point
                                 nbd->config = config  // 1
    
    Fix it by adding smp barrier to guarantee the execution sequence.
    
    Signed-off-by: Li Nan <linan122@xxxxxxxxxx>
    Reviewed-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20231116162316.1740402-4-linan666@xxxxxxxxxxxxxxx
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index daaf8805e876c..3f03cb3dc33cc 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -397,8 +397,16 @@ static u32 req_to_nbd_cmd_type(struct request *req)
 
 static struct nbd_config *nbd_get_config_unlocked(struct nbd_device *nbd)
 {
-	if (refcount_inc_not_zero(&nbd->config_refs))
+	if (refcount_inc_not_zero(&nbd->config_refs)) {
+		/*
+		 * Add smp_mb__after_atomic to ensure that reading nbd->config_refs
+		 * and reading nbd->config is ordered. The pair is the barrier in
+		 * nbd_alloc_and_init_config(), avoid nbd->config_refs is set
+		 * before nbd->config.
+		 */
+		smp_mb__after_atomic();
 		return nbd->config;
+	}
 
 	return NULL;
 }
@@ -1559,7 +1567,15 @@ static int nbd_alloc_and_init_config(struct nbd_device *nbd)
 	init_waitqueue_head(&config->conn_wait);
 	config->blksize_bits = NBD_DEF_BLKSIZE_BITS;
 	atomic_set(&config->live_connections, 0);
+
 	nbd->config = config;
+	/*
+	 * Order refcount_set(&nbd->config_refs, 1) and nbd->config assignment,
+	 * its pair is the barrier in nbd_get_config_unlocked().
+	 * So nbd_get_config_unlocked() won't see nbd->config as null after
+	 * refcount_inc_not_zero() succeed.
+	 */
+	smp_mb__before_atomic();
 	refcount_set(&nbd->config_refs, 1);
 
 	return 0;