From a5f8e86192612d0183047448d8bbe7918b3f1a26 Mon Sep 17 00:00:00 2001

From: Zhihao Cheng <chengzhihao1@huawei.com>

Date: Thu, 23 Sep 2021 21:49:21 +0800

Subject: [PATCH] blktrace: Fix uaf in blk_trace access after removing by sysfs

Git-commit: 5afedf670caf30a2b5a52da96eb7eac7dee6a9c9

Patch-mainline: v5.15-rc3

References: stable-5.14.9

[ Upstream commit 5afedf670caf30a2b5a52da96eb7eac7dee6a9c9 ]

There is an use-after-free problem triggered by following process:

      P1(sda)				P2(sdb)

			echo 0 > /sys/block/sdb/trace/enable

			  blk_trace_remove_queue

			    synchronize_rcu

			    blk_trace_free

			      relay_close

rcu_read_lock

__blk_add_trace

  trace_note_tsk

  (Iterate running_trace_list)

			        relay_close_buf

				  relay_destroy_buf

				    kfree(buf)

    trace_note(sdb's bt)

      relay_reserve

        buf->offset <- nullptr deference (use-after-free) !!!

rcu_read_unlock

[  502.714379] BUG: kernel NULL pointer dereference, address:

0000000000000010

[  502.715260] #PF: supervisor read access in kernel mode

[  502.715903] #PF: error_code(0x0000) - not-present page

[  502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0

[  502.717252] Oops: 0000 [#1] SMP

[  502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360

[  502.732872] Call Trace:

[  502.733193]  __blk_add_trace.cold+0x137/0x1a3

[  502.733734]  blk_add_trace_rq+0x7b/0xd0

[  502.734207]  blk_add_trace_rq_issue+0x54/0xa0

[  502.734755]  blk_mq_start_request+0xde/0x1b0

[  502.735287]  scsi_queue_rq+0x528/0x1140

...

[  502.742704]  sg_new_write.isra.0+0x16e/0x3e0

[  502.747501]  sg_ioctl+0x466/0x1100

Reproduce method:

  ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])

  ioctl(/dev/sda, BLKTRACESTART)

  ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])

  ioctl(/dev/sdb, BLKTRACESTART)

  echo 0 > /sys/block/sdb/trace/enable &

  // Add delay(mdelay/msleep) before kernel enters blk_trace_free()

  ioctl$SG_IO(/dev/sda, SG_IO, ...)

  // Enters trace_note_tsk() after blk_trace_free() returned

  // Use mdelay in rcu region rather than msleep(which may schedule out)

Remove blk_trace from running_list before calling blk_trace_free() by

sysfs if blk_trace is at Blktrace_running state.

Fixes: c71a896154119f ("blktrace: add ftrace plugin")

Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>

Link: https://lore.kernel.org/r/20210923134921.109194-1-chengzhihao1@huawei.com

Signed-off-by: Jens Axboe <axboe@kernel.dk>

Signed-off-by: Sasha Levin <sashal@kernel.org>

Acked-by: Takashi Iwai <tiwai@suse.de>

---

 kernel/trace/blktrace.c | 8 ++++++++

 1 file changed, 8 insertions(+)

diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c

index c221e4c3f625..fa91f398f28b 100644

--- a/kernel/trace/blktrace.c

+++ b/kernel/trace/blktrace.c

@@ -1605,6 +1605,14 @@ static int blk_trace_remove_queue(struct request_queue *q)

 	if (bt == NULL)

 		return -EINVAL;

+	if (bt->trace_state == Blktrace_running) {

+		bt->trace_state = Blktrace_stopped;

+		spin_lock_irq(&running_trace_lock);

+		list_del_init(&bt->running_list);

+		spin_unlock_irq(&running_trace_lock);

+		relay_flush(bt->rchan);

+	}

+

 	put_probe_ref();

 	synchronize_rcu();

 	blk_trace_free(bt);

-- 

2.26.2