From nobody Sat Feb 7 17:04:40 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 587F4C7EE24 for ; Tue, 6 Jun 2023 12:22:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236090AbjFFMWX (ORCPT ); Tue, 6 Jun 2023 08:22:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56108 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230297AbjFFMWU (ORCPT ); Tue, 6 Jun 2023 08:22:20 -0400 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 89F93E7D for ; Tue, 6 Jun 2023 05:22:18 -0700 (PDT) Received: from dggpemm500011.china.huawei.com (unknown [172.30.72.54]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4Qb8h12yhdz1c0Lj; Tue, 6 Jun 2023 20:20:33 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpemm500011.china.huawei.com (7.185.36.110) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.23; Tue, 6 Jun 2023 20:22:14 +0800 From: Li Lingfeng To: CC: , , , , , , Subject: [PATCH] dm thin: check fail_io before using data_sm Date: Tue, 6 Jun 2023 20:20:24 +0800 Message-ID: <20230606122024.1965040-1-lilingfeng3@huawei.com> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.175.127.227] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To dggpemm500011.china.huawei.com (7.185.36.110) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org We should check pmd->fail_io before using pmd->data_sm since pmd->data_sm may be destroyed by other processes. P1(kworker) P2(message) do_worker process_prepared process_prepared_discard_passdown_pt2 dm_pool_dec_data_range pool_message commit dm_pool_commit_metadata =E2=86=93 // commit failed metadata_operation_failed abort_transaction dm_pool_abort_metadata dm_block_manager_create =E2=86=93 // create failed __destroy_persistent_data_objects dm_sm_destroy(pmd->data_sm) =E2=86=93 // free data_sm dm_sm_dec_blocks =E2=86=93 // try to access pmd->data_sm --> UAF As shown above, if dm_pool_commit_metadata() and dm_block_manager_create() fail in pool_message process, kworker may trigger UAF. Signed-off-by: Li Lingfeng --- drivers/md/dm-thin-metadata.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c index 9f5cb52c5763..b9461faa9f0d 100644 --- a/drivers/md/dm-thin-metadata.c +++ b/drivers/md/dm-thin-metadata.c @@ -1756,13 +1756,15 @@ int dm_thin_remove_range(struct dm_thin_device *td, =20 int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bo= ol *result) { - int r; + int r =3D -EINVAL; uint32_t ref_count; =20 down_read(&pmd->root_lock); - r =3D dm_sm_get_count(pmd->data_sm, b, &ref_count); - if (!r) - *result =3D (ref_count > 1); + if (!pmd->fail_io) { + r =3D dm_sm_get_count(pmd->data_sm, b, &ref_count); + if (!r) + *result =3D (ref_count > 1); + } up_read(&pmd->root_lock); =20 return r; @@ -1770,10 +1772,11 @@ int dm_pool_block_is_shared(struct dm_pool_metadata= *pmd, dm_block_t b, bool *re =20 int dm_pool_inc_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_= block_t e) { - int r =3D 0; + int r =3D -EINVAL; =20 pmd_write_lock(pmd); - r =3D dm_sm_inc_blocks(pmd->data_sm, b, e); + if (!pmd->fail_io) + r =3D dm_sm_inc_blocks(pmd->data_sm, b, e); pmd_write_unlock(pmd); =20 return r; @@ -1781,10 +1784,11 @@ int dm_pool_inc_data_range(struct dm_pool_metadata = *pmd, dm_block_t b, dm_block_ =20 int dm_pool_dec_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_= block_t e) { - int r =3D 0; + int r =3D -EINVAL; =20 pmd_write_lock(pmd); - r =3D dm_sm_dec_blocks(pmd->data_sm, b, e); + if (!pmd->fail_io) + r =3D dm_sm_dec_blocks(pmd->data_sm, b, e); pmd_write_unlock(pmd); =20 return r; --=20 2.31.1