https://github.com/torvalds/linux
Revision cb65b282c9640c27d3129e2e04b711ce1b352838 authored by Li Lingfeng on 06 June 2023, 12:20:24 UTC, committed by Mike Snitzer on 15 June 2023, 16:46:59 UTC
Must check pmd->fail_io before using pmd->data_sm since pmd->data_sm may be destroyed by other processes. P1(kworker) P2(message) do_worker process_prepared process_prepared_discard_passdown_pt2 dm_pool_dec_data_range pool_message commit dm_pool_commit_metadata ↓ // commit failed metadata_operation_failed abort_transaction dm_pool_abort_metadata __open_or_format_metadata ↓ dm_sm_disk_open ↓ // open failed // pmd->data_sm is NULL dm_sm_dec_blocks ↓ // try to access pmd->data_sm --> UAF As shown above, if dm_pool_commit_metadata() and dm_pool_abort_metadata() fail in pool_message process, kworker may trigger UAF. Fixes: be500ed721a6 ("dm space maps: improve performance with inc/dec on ranges of blocks") Cc: stable@vger.kernel.org Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com> Signed-off-by: Mike Snitzer <snitzer@kernel.org>
1 parent 2760904
Tip revision: cb65b282c9640c27d3129e2e04b711ce1b352838 authored by Li Lingfeng on 06 June 2023, 12:20:24 UTC
dm thin metadata: check fail_io before using data_sm
dm thin metadata: check fail_io before using data_sm
Tip revision: cb65b28
File | Mode | Size |
---|---|---|
Documentation | ||
LICENSES | ||
arch | ||
block | ||
certs | ||
crypto | ||
drivers | ||
fs | ||
include | ||
init | ||
io_uring | ||
ipc | ||
kernel | ||
lib | ||
mm | ||
net | ||
rust | ||
samples | ||
scripts | ||
security | ||
sound | ||
tools | ||
usr | ||
virt | ||
.clang-format | -rw-r--r-- | 20.1 KB |
.cocciconfig | -rw-r--r-- | 59 bytes |
.get_maintainer.ignore | -rw-r--r-- | 151 bytes |
.gitattributes | -rw-r--r-- | 90 bytes |
.gitignore | -rw-r--r-- | 2.1 KB |
.mailmap | -rw-r--r-- | 27.6 KB |
.rustfmt.toml | -rw-r--r-- | 369 bytes |
COPYING | -rw-r--r-- | 496 bytes |
CREDITS | -rw-r--r-- | 100.1 KB |
Kbuild | -rw-r--r-- | 2.5 KB |
Kconfig | -rw-r--r-- | 555 bytes |
MAINTAINERS | -rw-r--r-- | 693.4 KB |
Makefile | -rw-r--r-- | 70.1 KB |
README | -rw-r--r-- | 727 bytes |
Computing file changes ...