kernel.git/drivers/md/dm-thin-metadata.c, branch linux-6.3.yHosts the 0x221E linux distro kernel.
https://git.0xinfinity.dev/distro/kernel.git/atom?h=linux-6.3.y2023-06-21T14:02:10Zdm thin metadata: check fail_io before using data_sm2023-06-21T14:02:10ZLi Lingfeng2023-06-06T12:20:24Zurn:sha1:a548701d0b0d5e045d1704a04c35213b390bd2ea
commit cb65b282c9640c27d3129e2e04b711ce1b352838 upstream.
Must check pmd->fail_io before using pmd->data_sm since
pmd->data_sm may be destroyed by other processes.
P1(kworker) P2(message)
do_worker
process_prepared
process_prepared_discard_passdown_pt2
dm_pool_dec_data_range
pool_message
commit
dm_pool_commit_metadata
↓
// commit failed
metadata_operation_failed
abort_transaction
dm_pool_abort_metadata
__open_or_format_metadata
↓
dm_sm_disk_open
↓
// open failed
// pmd->data_sm is NULL
dm_sm_dec_blocks
↓
// try to access pmd->data_sm --> UAF
As shown above, if dm_pool_commit_metadata() and
dm_pool_abort_metadata() fail in pool_message process, kworker may
trigger UAF.
Fixes: be500ed721a6 ("dm space maps: improve performance with inc/dec on ranges of blocks")
Cc: stable@vger.kernel.org
Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
dm: avoid useless 'else' after 'break' or return'2023-02-14T19:23:07ZHeinz Mauelshagen2023-02-07T19:35:25Zurn:sha1:1c3fe2fa946342a784a1375a63be6eb5a25acd76
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
dm: prefer '"%s...", __func__'2023-02-14T19:23:07ZHeinz Mauelshagen2023-02-06T22:42:32Zurn:sha1:1c13188669282dac48f1e67d77f07a746a4899d7
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
dm: avoid split of quoted strings where possible2023-02-14T19:23:07ZHeinz Mauelshagen2023-02-03T17:55:47Zurn:sha1:2e84fecf19e1694338deec8bf6c90ff84f8f31fb
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
dm: remove unnecessary braces from single statement blocks2023-02-14T19:23:06ZHeinz Mauelshagen2023-02-02T16:10:52Zurn:sha1:2d0f25cbc0d948e01573cc8ff5967e81bd98a4a1
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
dm: add missing empty lines2023-02-14T19:23:06ZHeinz Mauelshagen2023-02-01T22:42:29Zurn:sha1:0ef0b4717aa6849d251b23ae1efe93ca93af540b
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
dm: correct block comments format.2023-02-14T19:23:06ZHeinz Mauelshagen2023-01-26T14:48:30Zurn:sha1:a4a82ce3d24d4409143a7b7b980072ada6e20b2a
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
dm: change "unsigned" to "unsigned int"2023-02-14T19:23:06ZHeinz Mauelshagen2023-01-25T20:14:58Zurn:sha1:86a3238c7b9b759cb864f4f768ab2e24687dc0e6
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
dm: add missing SPDX-License-Indentifiers2023-02-14T19:23:06ZHeinz Mauelshagen2023-01-25T20:00:44Zurn:sha1:3bd940030752a33ff665eefdd74a1cdb74a4f9b0
'GPL-2.0-only' is used instead of 'GPL-2.0' because SPDX has
deprecated its use.
Suggested-by: John Wiele <jwiele@redhat.com>
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
dm thin: Use last transaction's pmd->root when commit failed2022-12-08T17:17:09ZZhihao Cheng2022-12-08T14:28:02Zurn:sha1:7991dbff6849f67e823b7cc0c15e5a90b0549b9f
Recently we found a softlock up problem in dm thin pool btree lookup
code due to corrupted metadata:
Kernel panic - not syncing: softlockup: hung tasks
CPU: 7 PID: 2669225 Comm: kworker/u16:3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
Workqueue: dm-thin do_worker [dm_thin_pool]
Call Trace:
<IRQ>
dump_stack+0x9c/0xd3
panic+0x35d/0x6b9
watchdog_timer_fn.cold+0x16/0x25
__run_hrtimer+0xa2/0x2d0
</IRQ>
RIP: 0010:__relink_lru+0x102/0x220 [dm_bufio]
__bufio_new+0x11f/0x4f0 [dm_bufio]
new_read+0xa3/0x1e0 [dm_bufio]
dm_bm_read_lock+0x33/0xd0 [dm_persistent_data]
ro_step+0x63/0x100 [dm_persistent_data]
btree_lookup_raw.constprop.0+0x44/0x220 [dm_persistent_data]
dm_btree_lookup+0x16f/0x210 [dm_persistent_data]
dm_thin_find_block+0x12c/0x210 [dm_thin_pool]
__process_bio_read_only+0xc5/0x400 [dm_thin_pool]
process_thin_deferred_bios+0x1a4/0x4a0 [dm_thin_pool]
process_one_work+0x3c5/0x730
Following process may generate a broken btree mixed with fresh and
stale btree nodes, which could get dm thin trapped in an infinite loop
while looking up data block:
Transaction 1: pmd->root = A, A->B->C // One path in btree
pmd->root = X, X->Y->Z // Copy-up
Transaction 2: X,Z is updated on disk, Y write failed.
// Commit failed, dm thin becomes read-only.
process_bio_read_only
dm_thin_find_block
__find_block
dm_btree_lookup(pmd->root)
The pmd->root points to a broken btree, Y may contain stale node
pointing to any block, for example X, which gets dm thin trapped into
a dead loop while looking up Z.
Fix this by setting pmd->root in __open_metadata(), so that dm thin
will use the last transaction's pmd->root if commit failed.
Fetch a reproducer in [Link].
Linke: https://bugzilla.kernel.org/show_bug.cgi?id=216790
Cc: stable@vger.kernel.org
Fixes: 991d9fa02da0 ("dm: add thin provisioning target")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Acked-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>