* [dm-devel] [PTACH] dm-mpath: fix UAF in multipath_message()
@ 2022-03-09 9:41 Luo Meng
2022-03-14 7:02 ` luomeng
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Luo Meng @ 2022-03-09 9:41 UTC (permalink / raw)
To: agk, snitzer, dm-devel; +Cc: luomeng12, yukuai3
If dm_get_device() create dd in multipath_message(),
and then call table_deps() after dm_put_table_device(),
it will lead to concurrency UAF bugs.
One of the concurrency UAF can be shown as below:
(USE) | (FREE)
| target_message
| multipath_message
| dm_put_device
| dm_put_table_device #
| kfree(td) # table_device *td
ioctl # DM_TABLE_DEPS_CMD | ...
table_deps | ...
dm_get_live_or_inactive_table | ...
retrieve_dep | ...
list_for_each_entry | ...
deps->dev[count++] = | ...
huge_encode_dev | ...
(dd->dm_dev->bdev->bd_dev) | list_del(&dd->list)
| kfree(dd) # dm_dev_internal
The root cause of UAF bugs is that find_device() failed in
dm_get_device() and will create dd and refcount set 1, kfree()
in dm_put_table() is not protected. When td, which there are
still pointers point to, is released, the concurrency UAF bug
will happen.
This patch add a flag to determine whether to create a new dd.
Signed-off-by: Luo Meng <luomeng12@huawei.com>
---
drivers/md/dm-mpath.c | 2 +-
drivers/md/dm-table.c | 43 +++++++++++++++++++++--------------
include/linux/device-mapper.h | 2 ++
3 files changed, 29 insertions(+), 18 deletions(-)
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index f4719b65e5e3..1f8b29ed7979 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1999,7 +1999,7 @@ static int multipath_message(struct dm_target *ti, unsigned argc, char **argv,
goto out;
}
- r = dm_get_device(ti, argv[1], dm_table_get_mode(ti->table), &dev);
+ r = __dm_get_device(ti, argv[1], dm_table_get_mode(ti->table), &dev, false);
if (r) {
DMWARN("message: error getting device %s",
argv[1]);
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index e43096cfe9e2..b8fc7e0afb84 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -340,12 +340,8 @@ dev_t dm_get_dev_t(const char *path)
}
EXPORT_SYMBOL_GPL(dm_get_dev_t);
-/*
- * Add a device to the list, or just increment the usage count if
- * it's already present.
- */
-int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
- struct dm_dev **result)
+int __dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
+ struct dm_dev **result, bool create_dd)
{
int r;
dev_t dev;
@@ -369,19 +365,21 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
dd = find_device(&t->devices, dev);
if (!dd) {
- dd = kmalloc(sizeof(*dd), GFP_KERNEL);
- if (!dd)
- return -ENOMEM;
-
- if ((r = dm_get_table_device(t->md, dev, mode, &dd->dm_dev))) {
- kfree(dd);
- return r;
- }
+ if (create_dd) {
+ dd = kmalloc(sizeof(*dd), GFP_KERNEL);
+ if (!dd)
+ return -ENOMEM;
- refcount_set(&dd->count, 1);
- list_add(&dd->list, &t->devices);
- goto out;
+ if ((r = dm_get_table_device(t->md, dev, mode, &dd->dm_dev))) {
+ kfree(dd);
+ return r;
+ }
+ refcount_set(&dd->count, 1);
+ list_add(&dd->list, &t->devices);
+ goto out;
+ } else
+ return -ENODEV;
} else if (dd->dm_dev->mode != (mode | dd->dm_dev->mode)) {
r = upgrade_mode(dd, mode, t->md);
if (r)
@@ -392,6 +390,17 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
*result = dd->dm_dev;
return 0;
}
+EXPORT_SYMBOL(__dm_get_device);
+
+/*
+ * Add a device to the list, or just increment the usage count if
+ * it's already present.
+ */
+int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
+ struct dm_dev **result)
+{
+ return __dm_get_device(ti, path, mode, result, true);
+}
EXPORT_SYMBOL(dm_get_device);
static int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index b26fecf6c8e8..a1b44789e3dc 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -168,6 +168,8 @@ dev_t dm_get_dev_t(const char *path);
int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
struct dm_dev **result);
void dm_put_device(struct dm_target *ti, struct dm_dev *d);
+int __dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
+ struct dm_dev **result, bool create_dd);
/*
* Information about a target type
--
2.31.1
--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [dm-devel] [PTACH] dm-mpath: fix UAF in multipath_message()
2022-03-09 9:41 [dm-devel] [PTACH] dm-mpath: fix UAF in multipath_message() Luo Meng
@ 2022-03-14 7:02 ` luomeng
2022-03-17 11:29 ` luomeng
2022-04-14 1:12 ` luomeng
2 siblings, 0 replies; 4+ messages in thread
From: luomeng @ 2022-03-14 7:02 UTC (permalink / raw)
To: agk, snitzer, dm-devel; +Cc: yukuai3
friendly ping.
在 2022/3/9 17:41, Luo Meng 写道:
> If dm_get_device() create dd in multipath_message(),
> and then call table_deps() after dm_put_table_device(),
> it will lead to concurrency UAF bugs.
>
> One of the concurrency UAF can be shown as below:
>
> (USE) | (FREE)
> | target_message
> | multipath_message
> | dm_put_device
> | dm_put_table_device #
> | kfree(td) # table_device *td
> ioctl # DM_TABLE_DEPS_CMD | ...
> table_deps | ...
> dm_get_live_or_inactive_table | ...
> retrieve_dep | ...
> list_for_each_entry | ...
> deps->dev[count++] = | ...
> huge_encode_dev | ...
> (dd->dm_dev->bdev->bd_dev) | list_del(&dd->list)
> | kfree(dd) # dm_dev_internal
>
> The root cause of UAF bugs is that find_device() failed in
> dm_get_device() and will create dd and refcount set 1, kfree()
> in dm_put_table() is not protected. When td, which there are
> still pointers point to, is released, the concurrency UAF bug
> will happen.
>
> This patch add a flag to determine whether to create a new dd.
>
> Signed-off-by: Luo Meng <luomeng12@huawei.com>
> ---
> drivers/md/dm-mpath.c | 2 +-
> drivers/md/dm-table.c | 43 +++++++++++++++++++++--------------
> include/linux/device-mapper.h | 2 ++
> 3 files changed, 29 insertions(+), 18 deletions(-)
>
> diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
> index f4719b65e5e3..1f8b29ed7979 100644
> --- a/drivers/md/dm-mpath.c
> +++ b/drivers/md/dm-mpath.c
> @@ -1999,7 +1999,7 @@ static int multipath_message(struct dm_target *ti, unsigned argc, char **argv,
> goto out;
> }
>
> - r = dm_get_device(ti, argv[1], dm_table_get_mode(ti->table), &dev);
> + r = __dm_get_device(ti, argv[1], dm_table_get_mode(ti->table), &dev, false);
> if (r) {
> DMWARN("message: error getting device %s",
> argv[1]);
> diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
> index e43096cfe9e2..b8fc7e0afb84 100644
> --- a/drivers/md/dm-table.c
> +++ b/drivers/md/dm-table.c
> @@ -340,12 +340,8 @@ dev_t dm_get_dev_t(const char *path)
> }
> EXPORT_SYMBOL_GPL(dm_get_dev_t);
>
> -/*
> - * Add a device to the list, or just increment the usage count if
> - * it's already present.
> - */
> -int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> - struct dm_dev **result)
> +int __dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> + struct dm_dev **result, bool create_dd)
> {
> int r;
> dev_t dev;
> @@ -369,19 +365,21 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
>
> dd = find_device(&t->devices, dev);
> if (!dd) {
> - dd = kmalloc(sizeof(*dd), GFP_KERNEL);
> - if (!dd)
> - return -ENOMEM;
> -
> - if ((r = dm_get_table_device(t->md, dev, mode, &dd->dm_dev))) {
> - kfree(dd);
> - return r;
> - }
> + if (create_dd) {
> + dd = kmalloc(sizeof(*dd), GFP_KERNEL);
> + if (!dd)
> + return -ENOMEM;
>
> - refcount_set(&dd->count, 1);
> - list_add(&dd->list, &t->devices);
> - goto out;
> + if ((r = dm_get_table_device(t->md, dev, mode, &dd->dm_dev))) {
> + kfree(dd);
> + return r;
> + }
>
> + refcount_set(&dd->count, 1);
> + list_add(&dd->list, &t->devices);
> + goto out;
> + } else
> + return -ENODEV;
> } else if (dd->dm_dev->mode != (mode | dd->dm_dev->mode)) {
> r = upgrade_mode(dd, mode, t->md);
> if (r)
> @@ -392,6 +390,17 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> *result = dd->dm_dev;
> return 0;
> }
> +EXPORT_SYMBOL(__dm_get_device);
> +
> +/*
> + * Add a device to the list, or just increment the usage count if
> + * it's already present.
> + */
> +int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> + struct dm_dev **result)
> +{
> + return __dm_get_device(ti, path, mode, result, true);
> +}
> EXPORT_SYMBOL(dm_get_device);
>
> static int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
> diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
> index b26fecf6c8e8..a1b44789e3dc 100644
> --- a/include/linux/device-mapper.h
> +++ b/include/linux/device-mapper.h
> @@ -168,6 +168,8 @@ dev_t dm_get_dev_t(const char *path);
> int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> struct dm_dev **result);
> void dm_put_device(struct dm_target *ti, struct dm_dev *d);
> +int __dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> + struct dm_dev **result, bool create_dd);
>
> /*
> * Information about a target type
>
--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [dm-devel] [PTACH] dm-mpath: fix UAF in multipath_message()
2022-03-09 9:41 [dm-devel] [PTACH] dm-mpath: fix UAF in multipath_message() Luo Meng
2022-03-14 7:02 ` luomeng
@ 2022-03-17 11:29 ` luomeng
2022-04-14 1:12 ` luomeng
2 siblings, 0 replies; 4+ messages in thread
From: luomeng @ 2022-03-17 11:29 UTC (permalink / raw)
To: agk, snitzer, dm-devel; +Cc: yukuai3
friendly ping.
在 2022/3/9 17:41, Luo Meng 写道:
> If dm_get_device() create dd in multipath_message(),
> and then call table_deps() after dm_put_table_device(),
> it will lead to concurrency UAF bugs.
>
> One of the concurrency UAF can be shown as below:
>
> (USE) | (FREE)
> | target_message
> | multipath_message
> | dm_put_device
> | dm_put_table_device #
> | kfree(td) # table_device *td
> ioctl # DM_TABLE_DEPS_CMD | ...
> table_deps | ...
> dm_get_live_or_inactive_table | ...
> retrieve_dep | ...
> list_for_each_entry | ...
> deps->dev[count++] = | ...
> huge_encode_dev | ...
> (dd->dm_dev->bdev->bd_dev) | list_del(&dd->list)
> | kfree(dd) # dm_dev_internal
>
> The root cause of UAF bugs is that find_device() failed in
> dm_get_device() and will create dd and refcount set 1, kfree()
> in dm_put_table() is not protected. When td, which there are
> still pointers point to, is released, the concurrency UAF bug
> will happen.
>
> This patch add a flag to determine whether to create a new dd.
>
> Signed-off-by: Luo Meng <luomeng12@huawei.com>
> ---
> drivers/md/dm-mpath.c | 2 +-
> drivers/md/dm-table.c | 43 +++++++++++++++++++++--------------
> include/linux/device-mapper.h | 2 ++
> 3 files changed, 29 insertions(+), 18 deletions(-)
>
> diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
> index f4719b65e5e3..1f8b29ed7979 100644
> --- a/drivers/md/dm-mpath.c
> +++ b/drivers/md/dm-mpath.c
> @@ -1999,7 +1999,7 @@ static int multipath_message(struct dm_target *ti, unsigned argc, char **argv,
> goto out;
> }
>
> - r = dm_get_device(ti, argv[1], dm_table_get_mode(ti->table), &dev);
> + r = __dm_get_device(ti, argv[1], dm_table_get_mode(ti->table), &dev, false);
> if (r) {
> DMWARN("message: error getting device %s",
> argv[1]);
> diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
> index e43096cfe9e2..b8fc7e0afb84 100644
> --- a/drivers/md/dm-table.c
> +++ b/drivers/md/dm-table.c
> @@ -340,12 +340,8 @@ dev_t dm_get_dev_t(const char *path)
> }
> EXPORT_SYMBOL_GPL(dm_get_dev_t);
>
> -/*
> - * Add a device to the list, or just increment the usage count if
> - * it's already present.
> - */
> -int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> - struct dm_dev **result)
> +int __dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> + struct dm_dev **result, bool create_dd)
> {
> int r;
> dev_t dev;
> @@ -369,19 +365,21 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
>
> dd = find_device(&t->devices, dev);
> if (!dd) {
> - dd = kmalloc(sizeof(*dd), GFP_KERNEL);
> - if (!dd)
> - return -ENOMEM;
> -
> - if ((r = dm_get_table_device(t->md, dev, mode, &dd->dm_dev))) {
> - kfree(dd);
> - return r;
> - }
> + if (create_dd) {
> + dd = kmalloc(sizeof(*dd), GFP_KERNEL);
> + if (!dd)
> + return -ENOMEM;
>
> - refcount_set(&dd->count, 1);
> - list_add(&dd->list, &t->devices);
> - goto out;
> + if ((r = dm_get_table_device(t->md, dev, mode, &dd->dm_dev))) {
> + kfree(dd);
> + return r;
> + }
>
> + refcount_set(&dd->count, 1);
> + list_add(&dd->list, &t->devices);
> + goto out;
> + } else
> + return -ENODEV;
> } else if (dd->dm_dev->mode != (mode | dd->dm_dev->mode)) {
> r = upgrade_mode(dd, mode, t->md);
> if (r)
> @@ -392,6 +390,17 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> *result = dd->dm_dev;
> return 0;
> }
> +EXPORT_SYMBOL(__dm_get_device);
> +
> +/*
> + * Add a device to the list, or just increment the usage count if
> + * it's already present.
> + */
> +int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> + struct dm_dev **result)
> +{
> + return __dm_get_device(ti, path, mode, result, true);
> +}
> EXPORT_SYMBOL(dm_get_device);
>
> static int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
> diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
> index b26fecf6c8e8..a1b44789e3dc 100644
> --- a/include/linux/device-mapper.h
> +++ b/include/linux/device-mapper.h
> @@ -168,6 +168,8 @@ dev_t dm_get_dev_t(const char *path);
> int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> struct dm_dev **result);
> void dm_put_device(struct dm_target *ti, struct dm_dev *d);
> +int __dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> + struct dm_dev **result, bool create_dd);
>
> /*
> * Information about a target type
>
--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [dm-devel] [PTACH] dm-mpath: fix UAF in multipath_message()
2022-03-09 9:41 [dm-devel] [PTACH] dm-mpath: fix UAF in multipath_message() Luo Meng
2022-03-14 7:02 ` luomeng
2022-03-17 11:29 ` luomeng
@ 2022-04-14 1:12 ` luomeng
2 siblings, 0 replies; 4+ messages in thread
From: luomeng @ 2022-04-14 1:12 UTC (permalink / raw)
To: agk, snitzer, dm-devel; +Cc: yukuai3
ping...
在 2022/3/9 17:41, Luo Meng 写道:
> If dm_get_device() create dd in multipath_message(),
> and then call table_deps() after dm_put_table_device(),
> it will lead to concurrency UAF bugs.
>
> One of the concurrency UAF can be shown as below:
>
> (USE) | (FREE)
> | target_message
> | multipath_message
> | dm_put_device
> | dm_put_table_device #
> | kfree(td) # table_device *td
> ioctl # DM_TABLE_DEPS_CMD | ...
> table_deps | ...
> dm_get_live_or_inactive_table | ...
> retrieve_dep | ...
> list_for_each_entry | ...
> deps->dev[count++] = | ...
> huge_encode_dev | ...
> (dd->dm_dev->bdev->bd_dev) | list_del(&dd->list)
> | kfree(dd) # dm_dev_internal
>
> The root cause of UAF bugs is that find_device() failed in
> dm_get_device() and will create dd and refcount set 1, kfree()
> in dm_put_table() is not protected. When td, which there are
> still pointers point to, is released, the concurrency UAF bug
> will happen.
>
> This patch add a flag to determine whether to create a new dd.
>
> Signed-off-by: Luo Meng <luomeng12@huawei.com>
> ---
> drivers/md/dm-mpath.c | 2 +-
> drivers/md/dm-table.c | 43 +++++++++++++++++++++--------------
> include/linux/device-mapper.h | 2 ++
> 3 files changed, 29 insertions(+), 18 deletions(-)
>
> diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
> index f4719b65e5e3..1f8b29ed7979 100644
> --- a/drivers/md/dm-mpath.c
> +++ b/drivers/md/dm-mpath.c
> @@ -1999,7 +1999,7 @@ static int multipath_message(struct dm_target *ti, unsigned argc, char **argv,
> goto out;
> }
>
> - r = dm_get_device(ti, argv[1], dm_table_get_mode(ti->table), &dev);
> + r = __dm_get_device(ti, argv[1], dm_table_get_mode(ti->table), &dev, false);
> if (r) {
> DMWARN("message: error getting device %s",
> argv[1]);
> diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
> index e43096cfe9e2..b8fc7e0afb84 100644
> --- a/drivers/md/dm-table.c
> +++ b/drivers/md/dm-table.c
> @@ -340,12 +340,8 @@ dev_t dm_get_dev_t(const char *path)
> }
> EXPORT_SYMBOL_GPL(dm_get_dev_t);
>
> -/*
> - * Add a device to the list, or just increment the usage count if
> - * it's already present.
> - */
> -int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> - struct dm_dev **result)
> +int __dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> + struct dm_dev **result, bool create_dd)
> {
> int r;
> dev_t dev;
> @@ -369,19 +365,21 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
>
> dd = find_device(&t->devices, dev);
> if (!dd) {
> - dd = kmalloc(sizeof(*dd), GFP_KERNEL);
> - if (!dd)
> - return -ENOMEM;
> -
> - if ((r = dm_get_table_device(t->md, dev, mode, &dd->dm_dev))) {
> - kfree(dd);
> - return r;
> - }
> + if (create_dd) {
> + dd = kmalloc(sizeof(*dd), GFP_KERNEL);
> + if (!dd)
> + return -ENOMEM;
>
> - refcount_set(&dd->count, 1);
> - list_add(&dd->list, &t->devices);
> - goto out;
> + if ((r = dm_get_table_device(t->md, dev, mode, &dd->dm_dev))) {
> + kfree(dd);
> + return r;
> + }
>
> + refcount_set(&dd->count, 1);
> + list_add(&dd->list, &t->devices);
> + goto out;
> + } else
> + return -ENODEV;
> } else if (dd->dm_dev->mode != (mode | dd->dm_dev->mode)) {
> r = upgrade_mode(dd, mode, t->md);
> if (r)
> @@ -392,6 +390,17 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> *result = dd->dm_dev;
> return 0;
> }
> +EXPORT_SYMBOL(__dm_get_device);
> +
> +/*
> + * Add a device to the list, or just increment the usage count if
> + * it's already present.
> + */
> +int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> + struct dm_dev **result)
> +{
> + return __dm_get_device(ti, path, mode, result, true);
> +}
> EXPORT_SYMBOL(dm_get_device);
>
> static int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
> diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
> index b26fecf6c8e8..a1b44789e3dc 100644
> --- a/include/linux/device-mapper.h
> +++ b/include/linux/device-mapper.h
> @@ -168,6 +168,8 @@ dev_t dm_get_dev_t(const char *path);
> int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> struct dm_dev **result);
> void dm_put_device(struct dm_target *ti, struct dm_dev *d);
> +int __dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
> + struct dm_dev **result, bool create_dd);
>
> /*
> * Information about a target type
>
--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-04-14 1:12 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-09 9:41 [dm-devel] [PTACH] dm-mpath: fix UAF in multipath_message() Luo Meng
2022-03-14 7:02 ` luomeng
2022-03-17 11:29 ` luomeng
2022-04-14 1:12 ` luomeng
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.