On 4/20/23 21:17, Sergei Shtepa wrote: > Subject: > Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module > From: > Sergei Shtepa > Date: > 4/20/23, 21:17 > > To: > Donald Buczek , axboe@kernel.dk, hch@infradead.org, corbet@lwn.net, snitzer@kernel.org > CC: > viro@zeniv.linux.org.uk, brauner@kernel.org, willy@infradead.org, kch@nvidia.com, martin.petersen@oracle.com, vkoul@kernel.org, ming.lei@redhat.com, gregkh@linuxfoundation.org, linux-block@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org > > > > On 4/20/23 16:44, Donald Buczek wrote: >> Subject: >> Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module >> From: >> Donald Buczek >> Date: >> 4/20/23, 16:44 >> >> To: >> Sergei Shtepa , axboe@kernel.dk, hch@infradead.org, corbet@lwn.net, snitzer@kernel.org >> CC: >> viro@zeniv.linux.org.uk, brauner@kernel.org, willy@infradead.org, kch@nvidia.com, martin.petersen@oracle.com, vkoul@kernel.org, ming.lei@redhat.com, gregkh@linuxfoundation.org, linux-block@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org >> >> >> On 4/19/23 21:42, Donald Buczek wrote: >>> Dear Sergei, >>> >>> On 4/19/23 15:05, Sergei Shtepa wrote: >>>> [...] >>>> >>>> Patches in attach and https://github.com/SergeiShtepa/linux/tree/blksnap-master >>> Thanks. I can confirm that this fixes the reported problem and I no longer can trigger the UAF. 😄 >>> >>> Tested-Bny: Donald Buczek >>> >>> Maybe you can add me to the cc list for v4 as I'm not subscribed to the lists. >> >> Sorry, found another one. Reproducer: >> >> ===== >> #! /bin/bash >> set -xe >> modprobe blksnap >> test -e /scratch/local/test.dat || fallocate -l 1G /scratch/local/test.dat >> s=$(blksnap snapshot_create -d /dev/vdb) >> blksnap snapshot_appendstorage -i $s -f /scratch/local/test.dat >> blksnap snapshot_take -i $s >> s2=$(blksnap snapshot_create -d /dev/vdb) >> blksnap snapshot_destroy -i $s2 >> blksnap snapshot_destroy -i $s >> ===== >> >> >> [20382.402921] blksnap-snapshot: Snapshot ff1c54f1-3e8c-4c99-bb26-35e82dc1c9fa was created >> [20382.535933] blksnap-image: Create snapshot image device for original device [253:16] >> [20382.542405] blksnap-snapshot: Snapshot ff1c54f1-3e8c-4c99-bb26-35e82dc1c9fa was taken successfully >> [20382.572564] blksnap-snapshot: Snapshot 4b2d571d-9a24-419d-96c2-8d64a07c4966 was created >> [20382.600521] blksnap-snapshot: Destroy snapshot 4b2d571d-9a24-419d-96c2-8d64a07c4966 >> [20382.602373] blksnap-snapshot: Release snapshot 4b2d571d-9a24-419d-96c2-8d64a07c4966 >> [20382.722137] blksnap-snapshot: Destroy snapshot ff1c54f1-3e8c-4c99-bb26-35e82dc1c9fa >> [20382.724033] blksnap-snapshot: Release snapshot ff1c54f1-3e8c-4c99-bb26-35e82dc1c9fa >> [20382.725850] ================================================================== >> [20382.727641] BUG: KASAN: wild-memory-access in snapshot_free+0x73/0x170 [blksnap] >> [20382.729326] Write of size 8 at addr dead000000000108 by task blksnap/8297 >> ... > Great! Thanks. > > There is no protection against re-adding a block device to the snapshot. > I'll take care of it. > Hi! I think the fix turned out to be quite beautiful. Now you will get an error "Device or resource busy". Fix in attach and on github. Link: https://github.com/SergeiShtepa/linux/commit/43a5d3dd9858f092b734187b6a62ce75acaa47c7