Re: [PATCH -next] block: fix use-after-free in __cpuhp_state_remove_instance

[Jens Axboe <axboe@kernel.dk>]

On 5/29/22 8:47 PM, Ye Bin wrote:
> We got issue when remove device mapper as follows:
> dmsetup create test --table "0 1048576 linear /dev/sda 0"
> dmsetup suspend --nolockfs test
> dmsetup load test --table "0 1048576 error /dev/sda 0"
> dmsetup resume test
> dmsetup suspend --nolockfs test
> dmsetup load test --table "0 1048576 linear /dev/sda 0"
> dmsetup resume test
> dmsetup remove test
> ==================================================================
> BUG: KASAN: wild-memory-access in __cpuhp_state_remove_instance+0x1ea/0x310
> Write of size 8 at addr dead000000000122 by task dmsetup/1969
> 
> CPU: 1 PID: 1969 Comm: dmsetup Not tainted 5.18.0-next-20220524 #225
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0x6e/0x91
>  print_report.cold+0x494/0x6b7
>  kasan_report+0xa9/0x120
>  __cpuhp_state_remove_instance+0x1ea/0x310
>  bioset_exit+0x45/0x2e0
>  cleanup_mapped_device+0x4f/0x190
>  __dm_destroy+0x230/0x3c0
>  dev_remove+0x18b/0x1d0
>  ctl_ioctl+0x3d8/0x7c0
>  dm_ctl_ioctl+0x21/0x30
>  __x64_sys_ioctl+0x12c/0x170
>  do_syscall_64+0x3b/0x90
>  entry_SYSCALL_64_after_hwframe+0x46/0xb0
> RIP: 0033:0x7f0d9aa7a8d7
> RSP: 002b:00007fff1ecedce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007f0d9ad5ff50 RCX: 00007f0d9aa7a8d7
> RDX: 000055c98c17d130 RSI: 00000000c138fd04 RDI: 0000000000000003
> RBP: 00007f0d9ad9a503 R08: 00007f0d9ad9b040 R09: 00007fff1ecedc10
> R10: 0000000000000006 R11: 0000000000000246 R12: 000055c98c17d130
> R13: 00007f0d9ad9a503 R14: 000055c98c17d050 R15: 00007f0d9ad9a503
> ==================================================================
> 
> As load different table may lead to bioset flag changes. But bio_alloc_cache_destroy
> to free cache depends on if cache is NULL, and also this after free cache didn't
> set 'bs->cache' NULL. So this will lead to UAF.
> To solve above issue just set ''bs->cache' NULL after free cache.
> 
> Fixes: be4d234d7aeb("bio: add allocation cache abstraction")
> Signed-off-by: Ye Bin <yebin10@huawei.com>
> ---
>  block/bio.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/block/bio.c b/block/bio.c
> index a3893d80dccc..be3937b84e68 100644
> --- a/block/bio.c
> +++ b/block/bio.c
> @@ -722,6 +722,7 @@ static void bio_alloc_cache_destroy(struct bio_set *bs)
>  		bio_alloc_cache_prune(cache, -1U);
>  	}
>  	free_percpu(bs->cache);
> +	bs->cache = NULL;
>  }
>  
>  /**

I already queued this up, just haven't sent it out yet:

https://git.kernel.dk/cgit/linux-block/commit/?h=for-5.19/block&id=605f7415ecfb426610195dd6c7577b30592b3369


-- 
Jens Axboe