[PATCH 2.6.19.2] SCSI sd: udev accessing an uninitialized scsi_disk results in a crash

[PATCH 2.6.19.2] SCSI sd: udev accessing an uninitialized scsi_disk results in a crash

[Nagendra Singh Tomar]

Hi,
	sd_probe() calls class_device_add() even before initializing the 
sdkp->device variable. class_device_add() eventually results in the user mode 
udev program to be called. udev program can read the the allow_restart 
attribute of the newly created scsi device. This is resulting in a crash as 
the show function for allow_restart (i.e sd_show_allow_restart) returns the 
attribute value by reading the sdkp->device->allow_restart variable. As the 
sdkp->device is not initialized before calling the user mode hotplug helper, 
this results in a crash.
	The patch below solves it by calling class_device_add() only after the 
necessary fields in the scsi_disk structure are initialized properly.


Thanx,
Tomar



Signed-off-by: Nagendra Singh Tomar <nagendra_tomar@adaptec.com>
---

--- linux-2.6.19.2/drivers/scsi/sd.c.orig	2007-02-02 17:03:03.000000000 +0530
+++ linux-2.6.19.2/drivers/scsi/sd.c	2007-02-02 17:04:04.000000000 +0530
@@ -1646,16 +1646,6 @@ static int sd_probe(struct device *dev)
 	if (error)
 		goto out_put;
 
-	class_device_initialize(&sdkp->cdev);
-	sdkp->cdev.dev = &sdp->sdev_gendev;
-	sdkp->cdev.class = &sd_disk_class;
-	strncpy(sdkp->cdev.class_id, sdp->sdev_gendev.bus_id, BUS_ID_SIZE);
-
-	if (class_device_add(&sdkp->cdev))
-		goto out_put;
-
-	get_device(&sdp->sdev_gendev);
-
 	sdkp->device = sdp;
 	sdkp->driver = &sd_template;
 	sdkp->disk = gd;
@@ -1669,6 +1659,16 @@ static int sd_probe(struct device *dev)
 			sdp->timeout = SD_MOD_TIMEOUT;
 	}
 
+	class_device_initialize(&sdkp->cdev);
+	sdkp->cdev.dev = &sdp->sdev_gendev;
+	sdkp->cdev.class = &sd_disk_class;
+	strncpy(sdkp->cdev.class_id, sdp->sdev_gendev.bus_id, BUS_ID_SIZE);
+
+	if (class_device_add(&sdkp->cdev))
+		goto out_put;
+
+	get_device(&sdp->sdev_gendev);
+
 	gd->major = sd_major((index & 0xf0) >> 4);
 	gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);
 	gd->minors = 16;

Re: [PATCH 2.6.19.2] SCSI sd: udev accessing an uninitialized scsi_disk results in a crash

[Andrew Morton]

On Fri, 2 Feb 2007 17:34:56 +0530
Nagendra Singh Tomar <nagendra_tomar@adaptec.com> wrote:

> Hi,
> 	sd_probe() calls class_device_add() even before initializing the 
> sdkp->device variable. class_device_add() eventually results in the user mode 
> udev program to be called. udev program can read the the allow_restart 
> attribute of the newly created scsi device. This is resulting in a crash as 
> the show function for allow_restart (i.e sd_show_allow_restart) returns the 
> attribute value by reading the sdkp->device->allow_restart variable. As the 
> sdkp->device is not initialized before calling the user mode hotplug helper, 
> this results in a crash.
> 	The patch below solves it by calling class_device_add() only after the 
> necessary fields in the scsi_disk structure are initialized properly.
> 
> 
> 
> --- linux-2.6.19.2/drivers/scsi/sd.c.orig	2007-02-02 17:03:03.000000000 +0530
> +++ linux-2.6.19.2/drivers/scsi/sd.c	2007-02-02 17:04:04.000000000 +0530
> @@ -1646,16 +1646,6 @@ static int sd_probe(struct device *dev)
>  	if (error)
>  		goto out_put;
>  
> -	class_device_initialize(&sdkp->cdev);
> -	sdkp->cdev.dev = &sdp->sdev_gendev;
> -	sdkp->cdev.class = &sd_disk_class;
> -	strncpy(sdkp->cdev.class_id, sdp->sdev_gendev.bus_id, BUS_ID_SIZE);
> -
> -	if (class_device_add(&sdkp->cdev))
> -		goto out_put;
> -
> -	get_device(&sdp->sdev_gendev);
> -
>  	sdkp->device = sdp;
>  	sdkp->driver = &sd_template;
>  	sdkp->disk = gd;
> @@ -1669,6 +1659,16 @@ static int sd_probe(struct device *dev)
>  			sdp->timeout = SD_MOD_TIMEOUT;
>  	}
>  
> +	class_device_initialize(&sdkp->cdev);
> +	sdkp->cdev.dev = &sdp->sdev_gendev;
> +	sdkp->cdev.class = &sd_disk_class;
> +	strncpy(sdkp->cdev.class_id, sdp->sdev_gendev.bus_id, BUS_ID_SIZE);
> +
> +	if (class_device_add(&sdkp->cdev))
> +		goto out_put;
> +
> +	get_device(&sdp->sdev_gendev);
> +
>  	gd->major = sd_major((index & 0xf0) >> 4);
>  	gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);
>  	gd->minors = 16;

Thanks - I'll queue this up for 2.6.20 also.

Re: [PATCH 2.6.19.2] SCSI sd: udev accessing an uninitialized scsi_disk results in a crash

[Greg KH]

On Fri, Feb 02, 2007 at 05:19:24PM -0800, Andrew Morton wrote:
> On Fri, 2 Feb 2007 17:34:56 +0530
> Nagendra Singh Tomar <nagendra_tomar@adaptec.com> wrote:
> 
> > Hi,
> > 	sd_probe() calls class_device_add() even before initializing the 
> > sdkp->device variable. class_device_add() eventually results in the user mode 
> > udev program to be called. udev program can read the the allow_restart 
> > attribute of the newly created scsi device. This is resulting in a crash as 
> > the show function for allow_restart (i.e sd_show_allow_restart) returns the 
> > attribute value by reading the sdkp->device->allow_restart variable. As the 
> > sdkp->device is not initialized before calling the user mode hotplug helper, 
> > this results in a crash.
> > 	The patch below solves it by calling class_device_add() only after the 
> > necessary fields in the scsi_disk structure are initialized properly.
> > 
> > 
> > 
> > --- linux-2.6.19.2/drivers/scsi/sd.c.orig	2007-02-02 17:03:03.000000000 +0530
> > +++ linux-2.6.19.2/drivers/scsi/sd.c	2007-02-02 17:04:04.000000000 +0530
> > @@ -1646,16 +1646,6 @@ static int sd_probe(struct device *dev)
> >  	if (error)
> >  		goto out_put;
> >  
> > -	class_device_initialize(&sdkp->cdev);
> > -	sdkp->cdev.dev = &sdp->sdev_gendev;
> > -	sdkp->cdev.class = &sd_disk_class;
> > -	strncpy(sdkp->cdev.class_id, sdp->sdev_gendev.bus_id, BUS_ID_SIZE);
> > -
> > -	if (class_device_add(&sdkp->cdev))
> > -		goto out_put;
> > -
> > -	get_device(&sdp->sdev_gendev);
> > -
> >  	sdkp->device = sdp;
> >  	sdkp->driver = &sd_template;
> >  	sdkp->disk = gd;
> > @@ -1669,6 +1659,16 @@ static int sd_probe(struct device *dev)
> >  			sdp->timeout = SD_MOD_TIMEOUT;
> >  	}
> >  
> > +	class_device_initialize(&sdkp->cdev);
> > +	sdkp->cdev.dev = &sdp->sdev_gendev;
> > +	sdkp->cdev.class = &sd_disk_class;
> > +	strncpy(sdkp->cdev.class_id, sdp->sdev_gendev.bus_id, BUS_ID_SIZE);
> > +
> > +	if (class_device_add(&sdkp->cdev))
> > +		goto out_put;
> > +
> > +	get_device(&sdp->sdev_gendev);
> > +
> >  	gd->major = sd_major((index & 0xf0) >> 4);
> >  	gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);
> >  	gd->minors = 16;
> 
> Thanks - I'll queue this up for 2.6.20 also.

No objection from me, as long as James says this is ok.

I wonder why we haven't noticed this in the past?

thanks,

greg k-h

Re: [PATCH 2.6.19.2] SCSI sd: udev accessing an uninitialized scsi_disk results in a crash

[James Bottomley]

On Fri, 2007-02-02 at 17:56 -0800, Greg KH wrote:
> > Thanks - I'll queue this up for 2.6.20 also.
> 
> No objection from me, as long as James says this is ok.
> 
> I wonder why we haven't noticed this in the past?

Because the race is so small ...

I'll queue it in the rc-fixes tree .. I have three others for 2.6.20

James