null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'

In the Linux kernel, the following vulnerability has been resolved:

null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'

Writing 'power' and 'submit_queues' concurrently will trigger kernel

panic:

Test script:

modprobe null_blk nr_devices=0

mkdir -p /sys/kernel/config/nullb/nullb0

while true; do echo 1 > submit_queues; echo 4 > submit_queues; done &

while true; do echo 1 > power; echo 0 > power; done

Test result:

BUG: kernel NULL pointer dereference, address: 0000000000000148

Oops: 0000 [#1] PREEMPT SMP

RIP: 0010:__lock_acquire+0x41d/0x28f0

Call Trace:

<TASK>

lock_acquire+0x121/0x450

down_write+0x5f/0x1d0

simple_recursive_removal+0x12f/0x5c0

blk_mq_debugfs_unregister_hctxs+0x7c/0x100

blk_mq_update_nr_hw_queues+0x4a3/0x720

nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]

nullb_device_submit_queues_store+0x79/0xf0 [null_blk]

configfs_write_iter+0x119/0x1e0

vfs_write+0x326/0x730

ksys_write+0x74/0x150

This is because del_gendisk() can concurrent with

blk_mq_update_nr_hw_queues():

nullb_device_power_store nullb_apply_submit_queues

null_del_dev

del_gendisk

nullb_update_nr_hw_queues

if (!dev->nullb)

// still set while gendisk is deleted

return 0

blk_mq_update_nr_hw_queues

dev->nullb = NULL

Fix this problem by resuing the global mutex to protect

nullb_device_power_store() and nullb_update_nr_hw_queues() from configfs.