Revision 7561cea5dbb97fecb952548a0fb74fb105bf4664 authored by Darrick J. Wong on 01 July 2022, 16:08:33 UTC, committed by Darrick J. Wong on 01 July 2022, 16:09:52 UTC
KASAN reported the following use after free bug when running generic/475: XFS (dm-0): Mounting V5 Filesystem XFS (dm-0): Starting recovery (logdev: internal) XFS (dm-0): Ending recovery (logdev: internal) Buffer I/O error on dev dm-0, logical block 20639616, async page read Buffer I/O error on dev dm-0, logical block 20639617, async page read XFS (dm-0): log I/O error -5 XFS (dm-0): Filesystem has been shut down due to log error (0x2). XFS (dm-0): Unmounting Filesystem XFS (dm-0): Please unmount the filesystem and rectify the problem(s). ================================================================== BUG: KASAN: use-after-free in do_raw_spin_lock+0x246/0x270 Read of size 4 at addr ffff888109dd84c4 by task 3:1H/136 CPU: 3 PID: 136 Comm: 3:1H Not tainted 5.19.0-rc4-xfsx #rc4 8e53ab5ad0fddeb31cee5e7063ff9c361915a9c4 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: xfs-log/dm-0 xlog_ioend_work [xfs] Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x2b8/0x661 ? do_raw_spin_lock+0x246/0x270 kasan_report+0xab/0x120 ? do_raw_spin_lock+0x246/0x270 do_raw_spin_lock+0x246/0x270 ? rwlock_bug.part.0+0x90/0x90 xlog_force_shutdown+0xf6/0x370 [xfs 4ad76ae0d6add7e8183a553e624c31e9ed567318] xlog_ioend_work+0x100/0x190 [xfs 4ad76ae0d6add7e8183a553e624c31e9ed567318] process_one_work+0x672/0x1040 worker_thread+0x59b/0xec0 ? __kthread_parkme+0xc6/0x1f0 ? process_one_work+0x1040/0x1040 ? process_one_work+0x1040/0x1040 kthread+0x29e/0x340 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 154099: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 kmem_alloc+0x8d/0x2e0 [xfs] xlog_cil_init+0x1f/0x540 [xfs] xlog_alloc_log+0xd1e/0x1260 [xfs] xfs_log_mount+0xba/0x640 [xfs] xfs_mountfs+0xf2b/0x1d00 [xfs] xfs_fs_fill_super+0x10af/0x1910 [xfs] get_tree_bdev+0x383/0x670 vfs_get_tree+0x7d/0x240 path_mount+0xdb7/0x1890 __x64_sys_mount+0x1fa/0x270 do_syscall_64+0x2b/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 154151: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_set_free_info+0x20/0x30 ____kasan_slab_free+0x110/0x190 slab_free_freelist_hook+0xab/0x180 kfree+0xbc/0x310 xlog_dealloc_log+0x1b/0x2b0 [xfs] xfs_unmountfs+0x119/0x200 [xfs] xfs_fs_put_super+0x6e/0x2e0 [xfs] generic_shutdown_super+0x12b/0x3a0 kill_block_super+0x95/0xd0 deactivate_locked_super+0x80/0x130 cleanup_mnt+0x329/0x4d0 task_work_run+0xc5/0x160 exit_to_user_mode_prepare+0xd4/0xe0 syscall_exit_to_user_mode+0x1d/0x40 entry_SYSCALL_64_after_hwframe+0x46/0xb0 This appears to be a race between the unmount process, which frees the CIL and waits for in-flight iclog IO; and the iclog IO completion. When generic/475 runs, it starts fsstress in the background, waits a few seconds, and substitutes a dm-error device to simulate a disk falling out of a machine. If the fsstress encounters EIO on a pure data write, it will exit but the filesystem will still be online. The next thing the test does is unmount the filesystem, which tries to clean the log, free the CIL, and wait for iclog IO completion. If an iclog was being written when the dm-error switch occurred, it can race with log unmounting as follows: Thread 1 Thread 2 xfs_log_unmount xfs_log_clean xfs_log_quiesce xlog_ioend_work <observe error> xlog_force_shutdown test_and_set_bit(XLOG_IOERROR) xfs_log_force <log is shut down, nop> xfs_log_umount_write <log is shut down, nop> xlog_dealloc_log xlog_cil_destroy <wait for iclogs> spin_lock(&log->l_cilp->xc_push_lock) <KABOOM> Therefore, free the CIL after waiting for the iclogs to complete. I /think/ this race has existed for quite a few years now, though I don't remember the ~2014 era logging code well enough to know if it was a real threat then or if the actual race was exposed only more recently. Fixes: ac983517ec59 ("xfs: don't sleep in xlog_cil_force_lsn on shutdown") Signed-off-by: Darrick J. Wong <djwong@kernel.org> Reviewed-by: Dave Chinner <dchinner@redhat.com>
1 parent 8944c6f
ecrdsa_defs.h
/* SPDX-License-Identifier: GPL-2.0+ */
/*
* Definitions of EC-RDSA Curve Parameters
*
* Copyright (c) 2019 Vitaly Chikunov <vt@altlinux.org>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the Free
* Software Foundation; either version 2 of the License, or (at your option)
* any later version.
*/
#ifndef _CRYTO_ECRDSA_DEFS_H
#define _CRYTO_ECRDSA_DEFS_H
#include <crypto/internal/ecc.h>
#define ECRDSA_MAX_SIG_SIZE (2 * 512 / 8)
#define ECRDSA_MAX_DIGITS (512 / 64)
/*
* EC-RDSA uses its own set of curves.
*
* cp256{a,b,c} curves first defined for GOST R 34.10-2001 in RFC 4357 (as
* 256-bit {A,B,C}-ParamSet), but inherited for GOST R 34.10-2012 and
* proposed for use in R 50.1.114-2016 and RFC 7836 as the 256-bit curves.
*/
/* OID_gostCPSignA 1.2.643.2.2.35.1 */
static u64 cp256a_g_x[] = {
0x0000000000000001ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull, };
static u64 cp256a_g_y[] = {
0x22ACC99C9E9F1E14ull, 0x35294F2DDF23E3B1ull,
0x27DF505A453F2B76ull, 0x8D91E471E0989CDAull, };
static u64 cp256a_p[] = { /* p = 2^256 - 617 */
0xFFFFFFFFFFFFFD97ull, 0xFFFFFFFFFFFFFFFFull,
0xFFFFFFFFFFFFFFFFull, 0xFFFFFFFFFFFFFFFFull };
static u64 cp256a_n[] = {
0x45841B09B761B893ull, 0x6C611070995AD100ull,
0xFFFFFFFFFFFFFFFFull, 0xFFFFFFFFFFFFFFFFull };
static u64 cp256a_a[] = { /* a = p - 3 */
0xFFFFFFFFFFFFFD94ull, 0xFFFFFFFFFFFFFFFFull,
0xFFFFFFFFFFFFFFFFull, 0xFFFFFFFFFFFFFFFFull };
static u64 cp256a_b[] = {
0x00000000000000a6ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull };
static struct ecc_curve gost_cp256a = {
.name = "cp256a",
.g = {
.x = cp256a_g_x,
.y = cp256a_g_y,
.ndigits = 256 / 64,
},
.p = cp256a_p,
.n = cp256a_n,
.a = cp256a_a,
.b = cp256a_b
};
/* OID_gostCPSignB 1.2.643.2.2.35.2 */
static u64 cp256b_g_x[] = {
0x0000000000000001ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull, };
static u64 cp256b_g_y[] = {
0x744BF8D717717EFCull, 0xC545C9858D03ECFBull,
0xB83D1C3EB2C070E5ull, 0x3FA8124359F96680ull, };
static u64 cp256b_p[] = { /* p = 2^255 + 3225 */
0x0000000000000C99ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x8000000000000000ull, };
static u64 cp256b_n[] = {
0xE497161BCC8A198Full, 0x5F700CFFF1A624E5ull,
0x0000000000000001ull, 0x8000000000000000ull, };
static u64 cp256b_a[] = { /* a = p - 3 */
0x0000000000000C96ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x8000000000000000ull, };
static u64 cp256b_b[] = {
0x2F49D4CE7E1BBC8Bull, 0xE979259373FF2B18ull,
0x66A7D3C25C3DF80Aull, 0x3E1AF419A269A5F8ull, };
static struct ecc_curve gost_cp256b = {
.name = "cp256b",
.g = {
.x = cp256b_g_x,
.y = cp256b_g_y,
.ndigits = 256 / 64,
},
.p = cp256b_p,
.n = cp256b_n,
.a = cp256b_a,
.b = cp256b_b
};
/* OID_gostCPSignC 1.2.643.2.2.35.3 */
static u64 cp256c_g_x[] = {
0x0000000000000000ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull, };
static u64 cp256c_g_y[] = {
0x366E550DFDB3BB67ull, 0x4D4DC440D4641A8Full,
0x3CBF3783CD08C0EEull, 0x41ECE55743711A8Cull, };
static u64 cp256c_p[] = {
0x7998F7B9022D759Bull, 0xCF846E86789051D3ull,
0xAB1EC85E6B41C8AAull, 0x9B9F605F5A858107ull,
/* pre-computed value for Barrett's reduction */
0xedc283cdd217b5a2ull, 0xbac48fc06398ae59ull,
0x405384d55f9f3b73ull, 0xa51f176161f1d734ull,
0x0000000000000001ull, };
static u64 cp256c_n[] = {
0xF02F3A6598980BB9ull, 0x582CA3511EDDFB74ull,
0xAB1EC85E6B41C8AAull, 0x9B9F605F5A858107ull, };
static u64 cp256c_a[] = { /* a = p - 3 */
0x7998F7B9022D7598ull, 0xCF846E86789051D3ull,
0xAB1EC85E6B41C8AAull, 0x9B9F605F5A858107ull, };
static u64 cp256c_b[] = {
0x000000000000805aull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull, };
static struct ecc_curve gost_cp256c = {
.name = "cp256c",
.g = {
.x = cp256c_g_x,
.y = cp256c_g_y,
.ndigits = 256 / 64,
},
.p = cp256c_p,
.n = cp256c_n,
.a = cp256c_a,
.b = cp256c_b
};
/* tc512{a,b} curves first recommended in 2013 and then standardized in
* R 50.1.114-2016 and RFC 7836 for use with GOST R 34.10-2012 (as TC26
* 512-bit ParamSet{A,B}).
*/
/* OID_gostTC26Sign512A 1.2.643.7.1.2.1.2.1 */
static u64 tc512a_g_x[] = {
0x0000000000000003ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull, };
static u64 tc512a_g_y[] = {
0x89A589CB5215F2A4ull, 0x8028FE5FC235F5B8ull,
0x3D75E6A50E3A41E9ull, 0xDF1626BE4FD036E9ull,
0x778064FDCBEFA921ull, 0xCE5E1C93ACF1ABC1ull,
0xA61B8816E25450E6ull, 0x7503CFE87A836AE3ull, };
static u64 tc512a_p[] = { /* p = 2^512 - 569 */
0xFFFFFFFFFFFFFDC7ull, 0xFFFFFFFFFFFFFFFFull,
0xFFFFFFFFFFFFFFFFull, 0xFFFFFFFFFFFFFFFFull,
0xFFFFFFFFFFFFFFFFull, 0xFFFFFFFFFFFFFFFFull,
0xFFFFFFFFFFFFFFFFull, 0xFFFFFFFFFFFFFFFFull, };
static u64 tc512a_n[] = {
0xCACDB1411F10B275ull, 0x9B4B38ABFAD2B85Dull,
0x6FF22B8D4E056060ull, 0x27E69532F48D8911ull,
0xFFFFFFFFFFFFFFFFull, 0xFFFFFFFFFFFFFFFFull,
0xFFFFFFFFFFFFFFFFull, 0xFFFFFFFFFFFFFFFFull, };
static u64 tc512a_a[] = { /* a = p - 3 */
0xFFFFFFFFFFFFFDC4ull, 0xFFFFFFFFFFFFFFFFull,
0xFFFFFFFFFFFFFFFFull, 0xFFFFFFFFFFFFFFFFull,
0xFFFFFFFFFFFFFFFFull, 0xFFFFFFFFFFFFFFFFull,
0xFFFFFFFFFFFFFFFFull, 0xFFFFFFFFFFFFFFFFull, };
static u64 tc512a_b[] = {
0x503190785A71C760ull, 0x862EF9D4EBEE4761ull,
0x4CB4574010DA90DDull, 0xEE3CB090F30D2761ull,
0x79BD081CFD0B6265ull, 0x34B82574761CB0E8ull,
0xC1BD0B2B6667F1DAull, 0xE8C2505DEDFC86DDull, };
static struct ecc_curve gost_tc512a = {
.name = "tc512a",
.g = {
.x = tc512a_g_x,
.y = tc512a_g_y,
.ndigits = 512 / 64,
},
.p = tc512a_p,
.n = tc512a_n,
.a = tc512a_a,
.b = tc512a_b
};
/* OID_gostTC26Sign512B 1.2.643.7.1.2.1.2.2 */
static u64 tc512b_g_x[] = {
0x0000000000000002ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull, };
static u64 tc512b_g_y[] = {
0x7E21340780FE41BDull, 0x28041055F94CEEECull,
0x152CBCAAF8C03988ull, 0xDCB228FD1EDF4A39ull,
0xBE6DD9E6C8EC7335ull, 0x3C123B697578C213ull,
0x2C071E3647A8940Full, 0x1A8F7EDA389B094Cull, };
static u64 tc512b_p[] = { /* p = 2^511 + 111 */
0x000000000000006Full, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x8000000000000000ull, };
static u64 tc512b_n[] = {
0xC6346C54374F25BDull, 0x8B996712101BEA0Eull,
0xACFDB77BD9D40CFAull, 0x49A1EC142565A545ull,
0x0000000000000001ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x8000000000000000ull, };
static u64 tc512b_a[] = { /* a = p - 3 */
0x000000000000006Cull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x0000000000000000ull,
0x0000000000000000ull, 0x8000000000000000ull, };
static u64 tc512b_b[] = {
0xFB8CCBC7C5140116ull, 0x50F78BEE1FA3106Eull,
0x7F8B276FAD1AB69Cull, 0x3E965D2DB1416D21ull,
0xBF85DC806C4B289Full, 0xB97C7D614AF138BCull,
0x7E3E06CF6F5E2517ull, 0x687D1B459DC84145ull, };
static struct ecc_curve gost_tc512b = {
.name = "tc512b",
.g = {
.x = tc512b_g_x,
.y = tc512b_g_y,
.ndigits = 512 / 64,
},
.p = tc512b_p,
.n = tc512b_n,
.a = tc512b_a,
.b = tc512b_b
};
#endif
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...