lkml.org 
[lkml]   [2019]   [Apr]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 030/121] dm thin: add sanity checks to thin-pool and external snapshot creation
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit 70de2cbda8a5d788284469e755f8b097d339c240 ]

    Invoking dm_get_device() twice on the same device path with different
    modes is dangerous. Because in that case, upgrade_mode() will alloc a
    new 'dm_dev' and free the old one, which may be referenced by a previous
    caller. Dereferencing the dangling pointer will trigger kernel NULL
    pointer dereference.

    The following two cases can reproduce this issue. Actually, they are
    invalid setups that must be disallowed, e.g.:

    1. Creating a thin-pool with read_only mode, and the same device as
    both metadata and data.

    dmsetup create thinp --table \
    "0 41943040 thin-pool /dev/vdb /dev/vdb 128 0 1 read_only"

    BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
    ...
    Call Trace:
    new_read+0xfb/0x110 [dm_bufio]
    dm_bm_read_lock+0x43/0x190 [dm_persistent_data]
    ? kmem_cache_alloc_trace+0x15c/0x1e0
    __create_persistent_data_objects+0x65/0x3e0 [dm_thin_pool]
    dm_pool_metadata_open+0x8c/0xf0 [dm_thin_pool]
    pool_ctr.cold.79+0x213/0x913 [dm_thin_pool]
    ? realloc_argv+0x50/0x70 [dm_mod]
    dm_table_add_target+0x14e/0x330 [dm_mod]
    table_load+0x122/0x2e0 [dm_mod]
    ? dev_status+0x40/0x40 [dm_mod]
    ctl_ioctl+0x1aa/0x3e0 [dm_mod]
    dm_ctl_ioctl+0xa/0x10 [dm_mod]
    do_vfs_ioctl+0xa2/0x600
    ? handle_mm_fault+0xda/0x200
    ? __do_page_fault+0x26c/0x4f0
    ksys_ioctl+0x60/0x90
    __x64_sys_ioctl+0x16/0x20
    do_syscall_64+0x55/0x150
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

    2. Creating a external snapshot using the same thin-pool device.

    dmsetup create thinp --table \
    "0 41943040 thin-pool /dev/vdc /dev/vdb 128 0 2 ignore_discard"
    dmsetup message /dev/mapper/thinp 0 "create_thin 0"
    dmsetup create snap --table \
    "0 204800 thin /dev/mapper/thinp 0 /dev/mapper/thinp"

    BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
    ...
    Call Trace:
    ? __alloc_pages_nodemask+0x13c/0x2e0
    retrieve_status+0xa5/0x1f0 [dm_mod]
    ? dm_get_live_or_inactive_table.isra.7+0x20/0x20 [dm_mod]
    table_status+0x61/0xa0 [dm_mod]
    ctl_ioctl+0x1aa/0x3e0 [dm_mod]
    dm_ctl_ioctl+0xa/0x10 [dm_mod]
    do_vfs_ioctl+0xa2/0x600
    ksys_ioctl+0x60/0x90
    ? ksys_write+0x4f/0xb0
    __x64_sys_ioctl+0x16/0x20
    do_syscall_64+0x55/0x150
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

    Signed-off-by: Jason Cai (Xiang Feng) <jason.cai@linux.alibaba.com>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/md/dm-thin.c | 13 +++++++++++++
    1 file changed, 13 insertions(+)

    diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
    index 18d6a8a10d5d..aa7795990989 100644
    --- a/drivers/md/dm-thin.c
    +++ b/drivers/md/dm-thin.c
    @@ -3292,6 +3292,13 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
    as.argc = argc;
    as.argv = argv;

    + /* make sure metadata and data are different devices */
    + if (!strcmp(argv[0], argv[1])) {
    + ti->error = "Error setting metadata or data device";
    + r = -EINVAL;
    + goto out_unlock;
    + }
    +
    /*
    * Set default pool features.
    */
    @@ -4173,6 +4180,12 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
    tc->sort_bio_list = RB_ROOT;

    if (argc == 3) {
    + if (!strcmp(argv[0], argv[2])) {
    + ti->error = "Error setting origin device";
    + r = -EINVAL;
    + goto bad_origin_dev;
    + }
    +
    r = dm_get_device(ti, argv[2], FMODE_READ, &origin_dev);
    if (r) {
    ti->error = "Error opening origin device";
    --
    2.19.1


    \
     
     \ /
      Last update: 2019-04-04 11:51    [W:4.226 / U:0.840 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site