kernel.git/drivers/md/dm-ioctl.c, branch linux-6.3.y

dm ioctl: Avoid double-fetch of version

2023-07-05T17:29:23Z

commit 249bed821b4db6d95a99160f7d6d236ea5fe6362 upstream. The version is fetched once in check_version(), which then does some validation and then overwrites the version in userspace with the API version supported by the kernel. copy_params() then fetches the version from userspace *again*, and this time no validation is done. The result is that the kernel's version number is completely controllable by userspace, provided that userspace can win a race condition. Fix this flaw by not copying the version back to the kernel the second time. This is not exploitable as the version is not further used in the kernel. However, it could become a problem if future patches start relying on the version field. Cc: stable@vger.kernel.org Signed-off-by: Demi Marie Obenour Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman

dm: don't lock fs when the map is NULL during suspend or resume

2023-06-21T14:02:18Z

[ Upstream commit 2760904d895279f87196f0fa9ec570c79fe6a2e4 ] As described in commit 38d11da522aa ("dm: don't lock fs when the map is NULL in process of resume"), a deadlock may be triggered between do_resume() and do_mount(). This commit preserves the fix from commit 38d11da522aa but moves it to where it also serves to fix a similar deadlock between do_suspend() and do_mount(). It does so, if the active map is NULL, by clearing DM_SUSPEND_LOCKFS_FLAG in dm_suspend() which is called by both do_suspend() and do_resume(). Fixes: 38d11da522aa ("dm: don't lock fs when the map is NULL in process of resume") Signed-off-by: Li Lingfeng Signed-off-by: Mike Snitzer Signed-off-by: Sasha Levin

dm: don't lock fs when the map is NULL in process of resume

2023-05-11T14:17:38Z

commit 38d11da522aacaa05898c734a1cec86f1e611129 upstream. Commit fa247089de99 ("dm: requeue IO if mapping table not yet available") added a detection of whether the mapping table is available in the IO submission process. If the mapping table is unavailable, it returns BLK_STS_RESOURCE and requeues the IO. This can lead to the following deadlock problem: dm create mount ioctl(DM_DEV_CREATE_CMD) ioctl(DM_TABLE_LOAD_CMD) do_mount vfs_get_tree ext4_get_tree get_tree_bdev sget_fc alloc_super // got &s->s_umount down_write_nested(&s->s_umount, ...); ext4_fill_super ext4_load_super ext4_read_bh submit_bio // submit and wait io end ioctl(DM_DEV_SUSPEND_CMD) dev_suspend do_resume dm_suspend __dm_suspend lock_fs freeze_bdev get_active_super grab_super // wait for &s->s_umount down_write(&s->s_umount); dm_swap_table __bind // set md->map(can't get here) IO will be continuously requeued while holding the lock since mapping table is NULL. At the same time, mapping table won't be set since the lock is not available. Like request-based DM, bio-based DM also has the same problem. It's not proper to just abort IO if the mapping table not available. So clear DM_SKIP_LOCKFS_FLAG when the mapping table is NULL, this allows the DM table to be loaded and the IO submitted upon resume. Fixes: fa247089de99 ("dm: requeue IO if mapping table not yet available") Cc: stable@vger.kernel.org Signed-off-by: Li Lingfeng Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman

dm ioctl: fix nested locking in table_clear() to remove deadlock concern

2023-05-11T14:17:38Z

commit 3d32aaa7e66d5c1479a3c31d6c2c5d45dd0d3b89 upstream. syzkaller found the following problematic rwsem locking (with write lock already held): down_read+0x9d/0x450 kernel/locking/rwsem.c:1509 dm_get_inactive_table+0x2b/0xc0 drivers/md/dm-ioctl.c:773 __dev_status+0x4fd/0x7c0 drivers/md/dm-ioctl.c:844 table_clear+0x197/0x280 drivers/md/dm-ioctl.c:1537 In table_clear, it first acquires a write lock https://elixir.bootlin.com/linux/v6.2/source/drivers/md/dm-ioctl.c#L1520 down_write(&_hash_lock); Then before the lock is released at L1539, there is a path shown above: table_clear -> __dev_status -> dm_get_inactive_table -> down_read https://elixir.bootlin.com/linux/v6.2/source/drivers/md/dm-ioctl.c#L773 down_read(&_hash_lock); It tries to acquire the same read lock again, resulting in the deadlock problem. Fix this by moving table_clear()'s __dev_status() call to after its up_write(&_hash_lock); Cc: stable@vger.kernel.org Reported-by: Zheng Zhang Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman

dm ioctl: remove unnecessary check when using dm_get_mdptr()

2023-02-17T19:49:21Z

__hash_remove() removes hash_cell with _hash_lock locked, so acquiring _hash_lock can guarantee no-NULL hc returned from dm_get_mdptr() must have not been removed and hc->md must still be md. __hash_remove() also acquires dm_hash_cells_mutex before setting mdptr as NULL. So in dm_copy_name_and_uuid(), after acquiring dm_hash_cells_mutex and ensuring returned hc is not NULL, the returned hc must still be alive and hc->md must still be md. Remove the unnecessary hc->md != md checks when using dm_get_mdptr() with _hash_lock or dm_hash_cells_mutex acquired. Signed-off-by: Hou Tao Signed-off-by: Mike Snitzer

dm ioctl: assert _hash_lock is held in __hash_remove

2023-02-17T19:49:21Z

Also update dm_early_create() to take _hash_lock when calling both __get_name_cell and __hash_remove -- given dm_early_create()'s early boot usecase this locking isn't about correctness but it allows lockdep_assert_held() to be added to __hash_remove. Signed-off-by: Mike Snitzer

dm ioctl: prefer strscpy() instead of strlcpy()

2023-02-14T19:23:07Z

Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer

dm ioctl: have constant on the right side of the test

2023-02-14T19:23:07Z

Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer

dm: prefer '"%s...", func'

2023-02-14T19:23:07Z

Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer

dm: avoid split of quoted strings where possible

2023-02-14T19:23:07Z

Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer

kernel.git/drivers/md/dm-ioctl.c, branch linux-6.3.y

dm ioctl: Avoid double-fetch of version

dm: don't lock fs when the map is NULL during suspend or resume

dm: don't lock fs when the map is NULL in process of resume

dm ioctl: fix nested locking in table_clear() to remove deadlock concern

dm ioctl: remove unnecessary check when using dm_get_mdptr()

dm ioctl: assert _hash_lock is held in __hash_remove

dm ioctl: prefer strscpy() instead of strlcpy()

dm ioctl: have constant on the right side of the test

dm: prefer '"%s...", __func__'

dm: avoid split of quoted strings where possible

dm: prefer '"%s...", func'