mirror of
https://github.com/torvalds/linux
synced 2024-10-17 08:46:50 +00:00
88430ebcbc
When dm_resume() and dm_destroy() are concurrent, it will
lead to UAF, as follows:
BUG: KASAN: use-after-free in __run_timers+0x173/0x710
Write of size 8 at addr ffff88816d9490f0 by task swapper/0/0
<snip>
Call Trace:
<IRQ>
dump_stack_lvl+0x73/0x9f
print_report.cold+0x132/0xaa2
_raw_spin_lock_irqsave+0xcd/0x160
__run_timers+0x173/0x710
kasan_report+0xad/0x110
__run_timers+0x173/0x710
__asan_store8+0x9c/0x140
__run_timers+0x173/0x710
call_timer_fn+0x310/0x310
pvclock_clocksource_read+0xfa/0x250
kvm_clock_read+0x2c/0x70
kvm_clock_get_cycles+0xd/0x20
ktime_get+0x5c/0x110
lapic_next_event+0x38/0x50
clockevents_program_event+0xf1/0x1e0
run_timer_softirq+0x49/0x90
__do_softirq+0x16e/0x62c
__irq_exit_rcu+0x1fa/0x270
irq_exit_rcu+0x12/0x20
sysvec_apic_timer_interrupt+0x8e/0xc0
One of the concurrency UAF can be shown as below:
use free
do_resume |
__find_device_hash_cell |
dm_get |
atomic_inc(&md->holders) |
| dm_destroy
| __dm_destroy
| if (!dm_suspended_md(md))
| atomic_read(&md->holders)
| msleep(1)
dm_resume |
__dm_resume |
dm_table_resume_targets |
pool_resume |
do_waker #add delay work |
dm_put |
atomic_dec(&md->holders) |
| dm_table_destroy
| pool_dtr
| __pool_dec
| __pool_destroy
| destroy_workqueue
| kfree(pool) # free pool
time out
__do_softirq
run_timer_softirq # pool has already been freed
This can be easily reproduced using:
1. create thin-pool
2. dmsetup suspend pool
3. dmsetup resume pool
4. dmsetup remove_all # Concurrent with 3
The root cause of this UAF bug is that dm_resume() adds timer after
dm_destroy() skips cancelling the timer because of suspend status.
After timeout, it will call run_timer_softirq(), however pool has
already been freed. The concurrency UAF bug will happen.
Therefore, cancelling timer again in __pool_destroy().
Cc: stable@vger.kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| bcache | ||
| persistent-data | ||
| dm-audit.c | ||
| dm-audit.h | ||
| dm-bio-prison-v1.c | ||
| dm-bio-prison-v1.h | ||
| dm-bio-prison-v2.c | ||
| dm-bio-prison-v2.h | ||
| dm-bio-record.h | ||
| dm-bufio.c | ||
| dm-builtin.c | ||
| dm-cache-background-tracker.c | ||
| dm-cache-background-tracker.h | ||
| dm-cache-block-types.h | ||
| dm-cache-metadata.c | ||
| dm-cache-metadata.h | ||
| dm-cache-policy-internal.h | ||
| dm-cache-policy-smq.c | ||
| dm-cache-policy.c | ||
| dm-cache-policy.h | ||
| dm-cache-target.c | ||
| dm-clone-metadata.c | ||
| dm-clone-metadata.h | ||
| dm-clone-target.c | ||
| dm-core.h | ||
| dm-crypt.c | ||
| dm-delay.c | ||
| dm-dust.c | ||
| dm-ebs-target.c | ||
| dm-era-target.c | ||
| dm-exception-store.c | ||
| dm-exception-store.h | ||
| dm-flakey.c | ||
| dm-ima.c | ||
| dm-ima.h | ||
| dm-init.c | ||
| dm-integrity.c | ||
| dm-io-rewind.c | ||
| dm-io-tracker.h | ||
| dm-io.c | ||
| dm-ioctl.c | ||
| dm-kcopyd.c | ||
| dm-linear.c | ||
| dm-log-userspace-base.c | ||
| dm-log-userspace-transfer.c | ||
| dm-log-userspace-transfer.h | ||
| dm-log-writes.c | ||
| dm-log.c | ||
| dm-mpath.c | ||
| dm-mpath.h | ||
| dm-path-selector.c | ||
| dm-path-selector.h | ||
| dm-ps-historical-service-time.c | ||
| dm-ps-io-affinity.c | ||
| dm-ps-queue-length.c | ||
| dm-ps-round-robin.c | ||
| dm-ps-service-time.c | ||
| dm-raid.c | ||
| dm-raid1.c | ||
| dm-region-hash.c | ||
| dm-rq.c | ||
| dm-rq.h | ||
| dm-snap-persistent.c | ||
| dm-snap-transient.c | ||
| dm-snap.c | ||
| dm-stats.c | ||
| dm-stats.h | ||
| dm-stripe.c | ||
| dm-switch.c | ||
| dm-sysfs.c | ||
| dm-table.c | ||
| dm-target.c | ||
| dm-thin-metadata.c | ||
| dm-thin-metadata.h | ||
| dm-thin.c | ||
| dm-uevent.c | ||
| dm-uevent.h | ||
| dm-unstripe.c | ||
| dm-verity-fec.c | ||
| dm-verity-fec.h | ||
| dm-verity-loadpin.c | ||
| dm-verity-target.c | ||
| dm-verity-verify-sig.c | ||
| dm-verity-verify-sig.h | ||
| dm-verity.h | ||
| dm-writecache.c | ||
| dm-zero.c | ||
| dm-zone.c | ||
| dm-zoned-metadata.c | ||
| dm-zoned-reclaim.c | ||
| dm-zoned-target.c | ||
| dm-zoned.h | ||
| dm.c | ||
| dm.h | ||
| Kconfig | ||
| Makefile | ||
| md-autodetect.c | ||
| md-bitmap.c | ||
| md-bitmap.h | ||
| md-cluster.c | ||
| md-cluster.h | ||
| md-faulty.c | ||
| md-linear.c | ||
| md-linear.h | ||
| md-multipath.c | ||
| md-multipath.h | ||
| md.c | ||
| md.h | ||
| raid0.c | ||
| raid0.h | ||
| raid1-10.c | ||
| raid1.c | ||
| raid1.h | ||
| raid5-cache.c | ||
| raid5-log.h | ||
| raid5-ppl.c | ||
| raid5.c | ||
| raid5.h | ||
| raid10.c | ||
| raid10.h | ||