| From d21fbe6b805a82193f7b2273cf4221efa91dce5b Mon Sep 17 00:00:00 2001 |
| From: Coly Li <colyli@suse.de> |
| Date: Sat, 1 Feb 2020 22:42:31 +0800 |
| Subject: [PATCH] bcache: fix memory corruption in bch_cache_accounting_clear() |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| commit 5bebf7486d4f4940b2a8e4009beb1dff5041853d upstream. |
| |
| Commit 83ff9318c44ba ("bcache: not use hard coded memset size in |
| bch_cache_accounting_clear()") tries to make the code more easy to |
| understand by removing the hard coded number with following change, |
| void bch_cache_accounting_clear(...) |
| { |
| memset(&acc->total.cache_hits, |
| 0, |
| - sizeof(unsigned long) * 7); |
| + sizeof(struct cache_stats)); |
| } |
| |
| Unfortunately the change was wrong (it also tells us the original code |
| was not easy to correctly understand). The hard coded number 7 is used |
| because in struct cache_stats, |
| 15 struct cache_stats { |
| 16 struct kobject kobj; |
| 17 |
| 18 unsigned long cache_hits; |
| 19 unsigned long cache_misses; |
| 20 unsigned long cache_bypass_hits; |
| 21 unsigned long cache_bypass_misses; |
| 22 unsigned long cache_readaheads; |
| 23 unsigned long cache_miss_collisions; |
| 24 unsigned long sectors_bypassed; |
| 25 |
| 26 unsigned int rescale; |
| 27 }; |
| only members in LINE 18-24 want to be set to 0. It is wrong to use |
| 'sizeof(struct cache_stats)' to replace 'sizeof(unsigned long) * 7), the |
| memory objects behind acc->total is staled by this change. |
| |
| Сорокин Артем Сергеевич reports that by the following steps, kernel |
| panic will be triggered, |
| 1. Create new set: make-bcache -B /dev/nvme1n1 -C /dev/sda --wipe-bcache |
| 2. Run in /sys/fs/bcache/<uuid>: |
| echo 1 > clear_stats && cat stats_five_minute/cache_bypass_hits |
| |
| I can reproduce the panic and get following dmesg with KASAN enabled, |
| [22613.172742] ================================================================== |
| [22613.172862] BUG: KASAN: null-ptr-deref in sysfs_kf_seq_show+0x117/0x230 |
| [22613.172864] Read of size 8 at addr 0000000000000000 by task cat/6753 |
| |
| [22613.172870] CPU: 1 PID: 6753 Comm: cat Not tainted 5.5.0-rc7-lp151.28.16-default+ #11 |
| [22613.172872] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019 |
| [22613.172873] Call Trace: |
| [22613.172964] dump_stack+0x8b/0xbb |
| [22613.172968] ? sysfs_kf_seq_show+0x117/0x230 |
| [22613.172970] ? sysfs_kf_seq_show+0x117/0x230 |
| [22613.173031] __kasan_report+0x176/0x192 |
| [22613.173064] ? pr_cont_kernfs_name+0x40/0x60 |
| [22613.173067] ? sysfs_kf_seq_show+0x117/0x230 |
| [22613.173070] kasan_report+0xe/0x20 |
| [22613.173072] sysfs_kf_seq_show+0x117/0x230 |
| [22613.173105] seq_read+0x199/0x6d0 |
| [22613.173110] vfs_read+0xa5/0x1a0 |
| [22613.173113] ksys_read+0x110/0x160 |
| [22613.173115] ? kernel_write+0xb0/0xb0 |
| [22613.173177] do_syscall_64+0x77/0x290 |
| [22613.173238] entry_SYSCALL_64_after_hwframe+0x44/0xa9 |
| [22613.173241] RIP: 0033:0x7fc2c886ac61 |
| [22613.173244] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89 |
| [22613.173245] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 |
| [22613.173248] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61 |
| [22613.173249] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003 |
| [22613.173250] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000 |
| [22613.173251] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000 |
| [22613.173253] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000 |
| [22613.173255] ================================================================== |
| [22613.173256] Disabling lock debugging due to kernel taint |
| [22613.173350] BUG: kernel NULL pointer dereference, address: 0000000000000000 |
| [22613.178380] #PF: supervisor read access in kernel mode |
| [22613.180959] #PF: error_code(0x0000) - not-present page |
| [22613.183444] PGD 0 P4D 0 |
| [22613.184867] Oops: 0000 [#1] SMP KASAN PTI |
| [22613.186797] CPU: 1 PID: 6753 Comm: cat Tainted: G B 5.5.0-rc7-lp151.28.16-default+ #11 |
| [22613.191253] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019 |
| [22613.196706] RIP: 0010:sysfs_kf_seq_show+0x117/0x230 |
| [22613.199097] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48 |
| [22613.208016] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246 |
| [22613.210448] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6 |
| [22613.213691] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246 |
| [22613.216893] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd |
| [22613.220075] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200 |
| [22613.223256] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000 |
| [22613.226290] FS: 00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000 |
| [22613.229637] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| [22613.231993] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0 |
| [22613.234909] Call Trace: |
| [22613.235931] seq_read+0x199/0x6d0 |
| [22613.237259] vfs_read+0xa5/0x1a0 |
| [22613.239229] ksys_read+0x110/0x160 |
| [22613.240590] ? kernel_write+0xb0/0xb0 |
| [22613.242040] do_syscall_64+0x77/0x290 |
| [22613.243625] entry_SYSCALL_64_after_hwframe+0x44/0xa9 |
| [22613.245450] RIP: 0033:0x7fc2c886ac61 |
| [22613.246706] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89 |
| [22613.253296] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 |
| [22613.255835] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61 |
| [22613.258472] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003 |
| [22613.260807] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000 |
| [22613.263188] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000 |
| [22613.265598] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000 |
| [22613.268729] Modules linked in: scsi_transport_iscsi af_packet iscsi_ibft iscsi_boot_sysfs vmw_vsock_vmci_transport vsock fuse bnep kvm_intel kvm irqbypass crc32_pclmul crc32c_intel ghash_clmulni_intel snd_ens1371 snd_ac97_codec ac97_bus bcache snd_pcm btusb btrtl btbcm btintel crc64 aesni_intel glue_helper crypto_simd vmw_balloon cryptd bluetooth snd_timer snd_rawmidi snd joydev pcspkr e1000 rfkill vmw_vmci soundcore ecdh_generic ecc gameport i2c_piix4 mptctl ac button hid_generic usbhid sr_mod cdrom ata_generic ehci_pci vmwgfx uhci_hcd drm_kms_helper syscopyarea serio_raw sysfillrect sysimgblt fb_sys_fops ttm ehci_hcd mptspi scsi_transport_spi mptscsih ata_piix mptbase ahci usbcore libahci drm sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua |
| [22613.292429] CR2: 0000000000000000 |
| [22613.293563] ---[ end trace a074b26a8508f378 ]--- |
| [22613.295138] RIP: 0010:sysfs_kf_seq_show+0x117/0x230 |
| [22613.296769] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48 |
| [22613.303553] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246 |
| [22613.305280] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6 |
| [22613.307924] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246 |
| [22613.310272] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd |
| [22613.312685] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200 |
| [22613.315076] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000 |
| [22613.318116] FS: 00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000 |
| [22613.320743] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| [22613.322628] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0 |
| |
| Here this patch fixes the following problem by explicity set all the 7 |
| members to 0 in bch_cache_accounting_clear(). |
| |
| Reported-by: Сорокин Артем Сергеевич <a.sorokin@bank-hlynov.ru> |
| Signed-off-by: Coly Li <colyli@suse.de> |
| Signed-off-by: Jens Axboe <axboe@kernel.dk> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/md/bcache/stats.c b/drivers/md/bcache/stats.c |
| index ba1c93791d8d..503aafe188dc 100644 |
| --- a/drivers/md/bcache/stats.c |
| +++ b/drivers/md/bcache/stats.c |
| @@ -109,9 +109,13 @@ int bch_cache_accounting_add_kobjs(struct cache_accounting *acc, |
| |
| void bch_cache_accounting_clear(struct cache_accounting *acc) |
| { |
| - memset(&acc->total.cache_hits, |
| - 0, |
| - sizeof(struct cache_stats)); |
| + acc->total.cache_hits = 0; |
| + acc->total.cache_misses = 0; |
| + acc->total.cache_bypass_hits = 0; |
| + acc->total.cache_bypass_misses = 0; |
| + acc->total.cache_readaheads = 0; |
| + acc->total.cache_miss_collisions = 0; |
| + acc->total.sectors_bypassed = 0; |
| } |
| |
| void bch_cache_accounting_destroy(struct cache_accounting *acc) |
| -- |
| 2.7.4 |
| |
