Messages in this thread | | | Date | Sat, 22 Apr 2023 22:01:29 +0200 | Subject | Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module | From | Donald Buczek <> |
| |
On 4/21/23 19:32, Sergei Shtepa wrote: > > > On 4/20/23 21:17, Sergei Shtepa wrote: >> Subject: >> Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module >> From: >> Sergei Shtepa <sergei.shtepa@veeam.com> >> Date: >> 4/20/23, 21:17 >> >> To: >> Donald Buczek <buczek@molgen.mpg.de>, axboe@kernel.dk, hch@infradead.org, corbet@lwn.net, snitzer@kernel.org >> CC: >> viro@zeniv.linux.org.uk, brauner@kernel.org, willy@infradead.org, kch@nvidia.com, martin.petersen@oracle.com, vkoul@kernel.org, ming.lei@redhat.com, gregkh@linuxfoundation.org, linux-block@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org >> >> >> >> On 4/20/23 16:44, Donald Buczek wrote: >>> Subject: >>> Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module >>> From: >>> Donald Buczek <buczek@molgen.mpg.de> >>> Date: >>> 4/20/23, 16:44 >>> >>> To: >>> Sergei Shtepa <sergei.shtepa@veeam.com>, axboe@kernel.dk, hch@infradead.org, corbet@lwn.net, snitzer@kernel.org >>> CC: >>> viro@zeniv.linux.org.uk, brauner@kernel.org, willy@infradead.org, kch@nvidia.com, martin.petersen@oracle.com, vkoul@kernel.org, ming.lei@redhat.com, gregkh@linuxfoundation.org, linux-block@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org >>> >>> >>> On 4/19/23 21:42, Donald Buczek wrote: >>>> Dear Sergei, >>>> >>>> On 4/19/23 15:05, Sergei Shtepa wrote: >>>>> [...] >>>>> >>>>> Patches in attach and https://github.com/SergeiShtepa/linux/tree/blksnap-master >>>> Thanks. I can confirm that this fixes the reported problem and I no longer can trigger the UAF. 😄 >>>> >>>> Tested-Bny: Donald Buczek <buczek@molgen.mpg.de> >>>> >>>> Maybe you can add me to the cc list for v4 as I'm not subscribed to the lists. >>> >>> Sorry, found another one. Reproducer: >>> >>> ===== >>> #! /bin/bash >>> set -xe >>> modprobe blksnap >>> test -e /scratch/local/test.dat || fallocate -l 1G /scratch/local/test.dat >>> s=$(blksnap snapshot_create -d /dev/vdb) >>> blksnap snapshot_appendstorage -i $s -f /scratch/local/test.dat >>> blksnap snapshot_take -i $s >>> s2=$(blksnap snapshot_create -d /dev/vdb) >>> blksnap snapshot_destroy -i $s2 >>> blksnap snapshot_destroy -i $s >>> ===== >>> >>> >>> [20382.402921] blksnap-snapshot: Snapshot ff1c54f1-3e8c-4c99-bb26-35e82dc1c9fa was created >>> [20382.535933] blksnap-image: Create snapshot image device for original device [253:16] >>> [20382.542405] blksnap-snapshot: Snapshot ff1c54f1-3e8c-4c99-bb26-35e82dc1c9fa was taken successfully >>> [20382.572564] blksnap-snapshot: Snapshot 4b2d571d-9a24-419d-96c2-8d64a07c4966 was created >>> [20382.600521] blksnap-snapshot: Destroy snapshot 4b2d571d-9a24-419d-96c2-8d64a07c4966 >>> [20382.602373] blksnap-snapshot: Release snapshot 4b2d571d-9a24-419d-96c2-8d64a07c4966 >>> [20382.722137] blksnap-snapshot: Destroy snapshot ff1c54f1-3e8c-4c99-bb26-35e82dc1c9fa >>> [20382.724033] blksnap-snapshot: Release snapshot ff1c54f1-3e8c-4c99-bb26-35e82dc1c9fa >>> [20382.725850] ================================================================== >>> [20382.727641] BUG: KASAN: wild-memory-access in snapshot_free+0x73/0x170 [blksnap] >>> [20382.729326] Write of size 8 at addr dead000000000108 by task blksnap/8297 >>> ... >> Great! Thanks. >> >> There is no protection against re-adding a block device to the snapshot. >> I'll take care of it. >> > > Hi! > > I think the fix turned out to be quite beautiful. > Now you will get an error "Device or resource busy". > Fix in attach and on github. > Link: https://github.com/SergeiShtepa/linux/commit/43a5d3dd9858f092b734187b6a62ce75acaa47c7
I can confirm, that this fixes the problem.
root@dose:~# blksnap snapshot_create -d /dev/vda -d /dev/vda fdcd3ee3-a25f-4c2a-93d7-2d951520e938 Operation already in progress root@dose:~# echo $? 1
Tested-By: Donald Buczek <buczek@molgen.mpg.de>
Best Donald
-- Donald Buczek buczek@molgen.mpg.de Tel: +49 30 8413 1433
| |