| Message ID | 20220530024729.2621465-1-yebin10@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [-next] block: fix use-after-free in __cpuhp_state_remove_instance | expand |
On 5/29/22 8:47 PM, Ye Bin wrote: > We got issue when remove device mapper as follows: > dmsetup create test --table "0 1048576 linear /dev/sda 0" > dmsetup suspend --nolockfs test > dmsetup load test --table "0 1048576 error /dev/sda 0" > dmsetup resume test > dmsetup suspend --nolockfs test > dmsetup load test --table "0 1048576 linear /dev/sda 0" > dmsetup resume test > dmsetup remove test > ================================================================== > BUG: KASAN: wild-memory-access in __cpuhp_state_remove_instance+0x1ea/0x310 > Write of size 8 at addr dead000000000122 by task dmsetup/1969 > > CPU: 1 PID: 1969 Comm: dmsetup Not tainted 5.18.0-next-20220524 #225 > Call Trace: > <TASK> > dump_stack_lvl+0x6e/0x91 > print_report.cold+0x494/0x6b7 > kasan_report+0xa9/0x120 > __cpuhp_state_remove_instance+0x1ea/0x310 > bioset_exit+0x45/0x2e0 > cleanup_mapped_device+0x4f/0x190 > __dm_destroy+0x230/0x3c0 > dev_remove+0x18b/0x1d0 > ctl_ioctl+0x3d8/0x7c0 > dm_ctl_ioctl+0x21/0x30 > __x64_sys_ioctl+0x12c/0x170 > do_syscall_64+0x3b/0x90 > entry_SYSCALL_64_after_hwframe+0x46/0xb0 > RIP: 0033:0x7f0d9aa7a8d7 > RSP: 002b:00007fff1ecedce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 > RAX: ffffffffffffffda RBX: 00007f0d9ad5ff50 RCX: 00007f0d9aa7a8d7 > RDX: 000055c98c17d130 RSI: 00000000c138fd04 RDI: 0000000000000003 > RBP: 00007f0d9ad9a503 R08: 00007f0d9ad9b040 R09: 00007fff1ecedc10 > R10: 0000000000000006 R11: 0000000000000246 R12: 000055c98c17d130 > R13: 00007f0d9ad9a503 R14: 000055c98c17d050 R15: 00007f0d9ad9a503 > ================================================================== > > As load different table may lead to bioset flag changes. But bio_alloc_cache_destroy > to free cache depends on if cache is NULL, and also this after free cache didn't > set 'bs->cache' NULL. So this will lead to UAF. > To solve above issue just set ''bs->cache' NULL after free cache. > > Fixes: be4d234d7aeb("bio: add allocation cache abstraction") > Signed-off-by: Ye Bin <yebin10@huawei.com> > --- > block/bio.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/block/bio.c b/block/bio.c > index a3893d80dccc..be3937b84e68 100644 > --- a/block/bio.c > +++ b/block/bio.c > @@ -722,6 +722,7 @@ static void bio_alloc_cache_destroy(struct bio_set *bs) > bio_alloc_cache_prune(cache, -1U); > } > free_percpu(bs->cache); > + bs->cache = NULL; > } > > /** I already queued this up, just haven't sent it out yet: https://git.kernel.dk/cgit/linux-block/commit/?h=for-5.19/block&id=605f7415ecfb426610195dd6c7577b30592b3369
diff --git a/block/bio.c b/block/bio.c index a3893d80dccc..be3937b84e68 100644 --- a/block/bio.c +++ b/block/bio.c @@ -722,6 +722,7 @@ static void bio_alloc_cache_destroy(struct bio_set *bs) bio_alloc_cache_prune(cache, -1U); } free_percpu(bs->cache); + bs->cache = NULL; } /**
We got issue when remove device mapper as follows: dmsetup create test --table "0 1048576 linear /dev/sda 0" dmsetup suspend --nolockfs test dmsetup load test --table "0 1048576 error /dev/sda 0" dmsetup resume test dmsetup suspend --nolockfs test dmsetup load test --table "0 1048576 linear /dev/sda 0" dmsetup resume test dmsetup remove test ================================================================== BUG: KASAN: wild-memory-access in __cpuhp_state_remove_instance+0x1ea/0x310 Write of size 8 at addr dead000000000122 by task dmsetup/1969 CPU: 1 PID: 1969 Comm: dmsetup Not tainted 5.18.0-next-20220524 #225 Call Trace: <TASK> dump_stack_lvl+0x6e/0x91 print_report.cold+0x494/0x6b7 kasan_report+0xa9/0x120 __cpuhp_state_remove_instance+0x1ea/0x310 bioset_exit+0x45/0x2e0 cleanup_mapped_device+0x4f/0x190 __dm_destroy+0x230/0x3c0 dev_remove+0x18b/0x1d0 ctl_ioctl+0x3d8/0x7c0 dm_ctl_ioctl+0x21/0x30 __x64_sys_ioctl+0x12c/0x170 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f0d9aa7a8d7 RSP: 002b:00007fff1ecedce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f0d9ad5ff50 RCX: 00007f0d9aa7a8d7 RDX: 000055c98c17d130 RSI: 00000000c138fd04 RDI: 0000000000000003 RBP: 00007f0d9ad9a503 R08: 00007f0d9ad9b040 R09: 00007fff1ecedc10 R10: 0000000000000006 R11: 0000000000000246 R12: 000055c98c17d130 R13: 00007f0d9ad9a503 R14: 000055c98c17d050 R15: 00007f0d9ad9a503 ================================================================== As load different table may lead to bioset flag changes. But bio_alloc_cache_destroy to free cache depends on if cache is NULL, and also this after free cache didn't set 'bs->cache' NULL. So this will lead to UAF. To solve above issue just set ''bs->cache' NULL after free cache. Fixes: be4d234d7aeb("bio: add allocation cache abstraction") Signed-off-by: Ye Bin <yebin10@huawei.com> --- block/bio.c | 1 + 1 file changed, 1 insertion(+)