From patchwork Fri Jul 28 23:17:20 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yuxuan Luo X-Patchwork-Id: 1814458 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=OhY8ef7P; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RCNpC1f5dz1yf1 for ; Sat, 29 Jul 2023 09:17:39 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1qPWiC-0007yr-Pi; Fri, 28 Jul 2023 23:17:32 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1qPWiA-0007xp-ME for kernel-team@lists.ubuntu.com; Fri, 28 Jul 2023 23:17:30 +0000 Received: from mail-qv1-f70.google.com (mail-qv1-f70.google.com [209.85.219.70]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 5F1B83F71D for ; Fri, 28 Jul 2023 23:17:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1690586250; bh=7IrdMU9gWkD1fICtlm/vFRj1DJA3QInw+ag6q0qw4R8=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=OhY8ef7Pze8pc/kkMSepbvqh15Xzm23D9jONQKXB7qxdr41EvGy5KIoiuw8VnfB6s NtZAwJwuIeHWAw10xel0X8qTIJbWuCYBwQEzh2Nl9bpA6qgJ7cwG5JZEZTcvyGOfvY 72gAOcU9YJLp91biPH66yaYst1xJs367HTOyDwGFdBO1gczt8sCn+yNdbeiprkTUrs wHX15KFGW/k34Tf5JrKPYjr7ZErvrxy46vZCKu06uuCSkrdb6AIaLuavueIfQ6DP1B rmAZ1rczTsVxz+6u6fqyKhf9+a/6wDuqm75svOg0vbgZIznjIKBRfJ3LH+wzroyLMO /U6el441BZWgA== Received: by mail-qv1-f70.google.com with SMTP id 6a1803df08f44-63cfc4ebcecso28460366d6.1 for ; Fri, 28 Jul 2023 16:17:30 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1690586248; x=1691191048; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=7IrdMU9gWkD1fICtlm/vFRj1DJA3QInw+ag6q0qw4R8=; b=KoiL1Y79BxASsc1E6nQA2YbzYUPDZmAL3zE3x0nAIY57EjnBKnOa+Rd+JpDwsi4xRi jQMQJ/er5mip04JFKt1rN1WQn88MDYENo5USQR6iY9DMBnIgizdrscEy6eyrkGyitX0+ fVKUL9CCybQ16VTQGNDVDSwV47mslAv1nwN+QjLnmYgTc2LhzIl1YgQ/yddDpBYmZGSg L30tndpmOpeF5fym0abG1nnUroUebGmefx0gH3dBzyVPxwPnP8mD9qAVyivyfQGP6BWf x7sZG8IE4aH8gg/5VVvbxcGkE1ADYU1HuLUn2WV3LofbOB6Ujvt5v3wpHT+c2YpQ+VUq PP/w== X-Gm-Message-State: ABy/qLbpQDbNV7JZq/CHbWLi4eQv1yshEGlq2paT35qEs0qz8YKqY3dg R8DKcmQleWBavuJKL3+YcJvuGsmWcnwzSDkFCV7LA3odbxacdL13hF1ThmwY7fH1UYfu2fGWzmy vBsSMOItXPCRlF9PXUC5cO3v1LNev7y35r/jKDdmsxhvj1ef5oQ== X-Received: by 2002:a0c:df89:0:b0:63d:e3:414a with SMTP id w9-20020a0cdf89000000b0063d00e3414amr4158626qvl.25.1690586248177; Fri, 28 Jul 2023 16:17:28 -0700 (PDT) X-Google-Smtp-Source: APBJJlGsf+/OUT53wTxGxnrjSGlsOHEoNmCqHlIvqS/83RHWxCRZA94NiLmsRZIf+0YW3wWsZErUaA== X-Received: by 2002:a0c:df89:0:b0:63d:e3:414a with SMTP id w9-20020a0cdf89000000b0063d00e3414amr4158616qvl.25.1690586247916; Fri, 28 Jul 2023 16:17:27 -0700 (PDT) Received: from cache-ubuntu.hsd1.nj.comcast.net ([2601:86:200:98b0:da04:6059:8f11:999b]) by smtp.gmail.com with ESMTPSA id d28-20020a0caa1c000000b006363f2c37f0sm1617060qvb.91.2023.07.28.16.17.26 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 28 Jul 2023 16:17:27 -0700 (PDT) From: Yuxuan Luo To: kernel-team@lists.ubuntu.com Subject: [SRU][Jammy-OEM-6.0][PATCH 1/1] dm ioctl: fix nested locking in table_clear() to remove deadlock concern Date: Fri, 28 Jul 2023 19:17:20 -0400 Message-Id: <20230728231720.104751-3-yuxuan.luo@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230728231720.104751-1-yuxuan.luo@canonical.com> References: <20230728231720.104751-1-yuxuan.luo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Mike Snitzer syzkaller found the following problematic rwsem locking (with write lock already held): down_read+0x9d/0x450 kernel/locking/rwsem.c:1509 dm_get_inactive_table+0x2b/0xc0 drivers/md/dm-ioctl.c:773 __dev_status+0x4fd/0x7c0 drivers/md/dm-ioctl.c:844 table_clear+0x197/0x280 drivers/md/dm-ioctl.c:1537 In table_clear, it first acquires a write lock https://elixir.bootlin.com/linux/v6.2/source/drivers/md/dm-ioctl.c#L1520 down_write(&_hash_lock); Then before the lock is released at L1539, there is a path shown above: table_clear -> __dev_status -> dm_get_inactive_table -> down_read https://elixir.bootlin.com/linux/v6.2/source/drivers/md/dm-ioctl.c#L773 down_read(&_hash_lock); It tries to acquire the same read lock again, resulting in the deadlock problem. Fix this by moving table_clear()'s __dev_status() call to after its up_write(&_hash_lock); Cc: stable@vger.kernel.org Reported-by: Zheng Zhang Signed-off-by: Mike Snitzer (cherry picked from commit 3d32aaa7e66d5c1479a3c31d6c2c5d45dd0d3b89) CVE-2023-2269 Signed-off-by: Yuxuan Luo --- drivers/md/dm-ioctl.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index 98976aaa9db9..9dbcfe21bc86 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1532,11 +1532,12 @@ static int table_clear(struct file *filp, struct dm_ioctl *param, size_t param_s has_new_map = true; } - param->flags &= ~DM_INACTIVE_PRESENT_FLAG; - - __dev_status(hc->md, param); md = hc->md; up_write(&_hash_lock); + + param->flags &= ~DM_INACTIVE_PRESENT_FLAG; + __dev_status(md, param); + if (old_map) { dm_sync_table(md); dm_table_destroy(old_map);