linux-kernel - [PATCH] percpu_counter: Add NULL check to prevent crash in __percpu_counter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 16 May 2017 15:42:57 +0530
From:   Niranjan Dighe <niranjan.dighe@...il.com>
To:     linux-kernel@...r.kernel.org
Subject: [PATCH] percpu_counter: Add NULL check to prevent crash in
 __percpu_counter_add

From: Niranjan Dighe <ndighe@...teon.com>

Following kernel crash was observed because of a possible race condition in
block layer that passes struct percpu_counter *fcp with fcp->counters field
NULL. Added extra checks to prevent similar crashes because of bugs in the
upper layers.

This is fairly easy to reproduce with kernel 4.1.15+ when a USB device is
mounted on multiple mount points with a -B (bind) option and multiple
connection/disconnections are made repeatedly.

---

Unable to handle kernel paging request at virtual address 2ac60000
pgd = a2918000
[2ac60000] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT SMP ARM
Modules linked in: vfat fat sd_mod ntfs usb_storage scsi_mod usbhid hid
snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi fuse sd8xxx(O) mlan(PO)
mmc_block spidev sdhci_esdhc_imx sdhci_pltfm sdhci spi_imx spi_bitbang ext4
jbd2 ipv6
CPU: 0 PID: 319 Comm: usbmgr Tainted: P        W  O    4.1.15-1.2.0+g77f6154 #2
Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
task: a23b7c00 ti: a843c000 task.ti: a843c000
PC is at __percpu_counter_add+0x34/0xf8
LR is at clear_page_dirty_for_io+0xc4/0xe0
pc : [<80213708>]    lr : [<80098810>]    psr: 200f0093
sp : a843de00  ip : a843de00  fp : abb6a0a0
r10: a843def8  r9 : 0000019b  r8 : a6020b64
r7 : 00000000  r6 : 00000002  r5 : ffffffff  r4 : ffffffff
r3 : 00000000  r2 : 00000010  r1 : 2ac60000  r0 : a8334920
Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c53c7d  Table: 3291804a  DAC: 00000015
Process usbmgr (pid: 319, stack limit = 0xa843c210)
Stack: (0xa843de00 to 0xa843e000)
de00: 200f0013 a6020b64 00000002 ffffffff a6020b64 0000019b a843def8 80098810
de20: 00000010 8009ab24 a843de70 00000000 a843de70 8009896c 0000000e 00000000
de40: 00000000 00000000 800982dc a6020b64 00000002 00000001 00000001 a81b5e20
de60: a00f0193 000008e3 00000002 00000000 abb6a0a0 abc1b7c0 758045a0 80054b74
de80: 0000406f 8027ce94 a81b5c10 5355843b 00000000 00000001 00000001 00004000
dea0: 00000125 a81843c0 80ba11a8 a6020b64 a843def8 ffffffff 7fffffff 00000000
dec0: 00000000 00000000 758045a0 80098be8 a843ded0 a843ded0 a843ded8 a843ded8
dee0: a843dee0 a843dee0 a6020b64 a6020b64 00000001 8009064c 7fffffff 00000000
df00: 00000000 00000000 ffffffff 7fffffff 00000001 00000000 8000f684 a6020b64
df20: 00000081 ffffffff 7fffffff 8000f684 a843c000 800906ec ffffffff 7fffffff
df40: 00000001 a23b7c00 8000f684 a6020a00 00000081 80ba2ca4 a23b7c00 800cdf5c
df60: a3090c00 7f343ea4 80ba2ca4 800ce224 a2b06840 00000000 80ba2ca4 800e7aec
df80: a23b7f78 8003e124 a843c000 8000f684 a843dfb0 00000034 8000f684 80012000
dfa0: 758045a8 00000018 00000001 8000f54c 00000000 00000002 00000001 76f0dcfc
dfc0: 758045a8 00000018 00000001 00000034 aaaaaaab 00083d48 758045a0 758045a0
dfe0: 0009945c 7696dc0c 0006c31c 76b175bc 60010010 758045a8 00000000 00000000
[<80213708>] (__percpu_counter_add) from [<80098810>] (clear_page_dirty_for_io+0xc4/0xe0)
[<80098810>] (clear_page_dirty_for_io) from [<8009896c>] (write_cache_pages+0x140/0x37c)
[<8009896c>] (write_cache_pages) from [<80098be8>] (generic_writepages+0x40/0x60)
[<80098be8>] (generic_writepages) from [<8009064c>] (__filemap_fdatawrite_range+0x64/0x6c)
[<8009064c>] (__filemap_fdatawrite_range) from [<800906ec>] (filemap_write_and_wait+0x38/0x64)
[<800906ec>] (filemap_write_and_wait) from [<800cdf5c>] (kill_block_super+0x20/0x68)
[<800cdf5c>] (kill_block_super) from [<800ce224>] (deactivate_locked_super+0x58/0x7c)
[<800ce224>] (deactivate_locked_super) from [<800e7aec>] (cleanup_mnt+0x38/0x7c)
[<800e7aec>] (cleanup_mnt) from [<8003e124>] (task_work_run+0xac/0xe4)
[<8003e124>] (task_work_run) from [<80012000>] (do_work_pending+0x7c/0xa4)
[<80012000>] (do_work_pending) from [<8000f54c>] (work_pending+0xc/0x20)
Code: e5813004 e5903018 e1a07fc2 ee1d1f90 (e7933001)
---[ end trace 4b693779c2eb6edd ]---

Signed-off-by: Niranjan Dighe <ndighe@...teon.com>
---
 lib/percpu_counter.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/percpu_counter.c b/lib/percpu_counter.c
index f051d69..4e8c163 100644
--- a/lib/percpu_counter.c
+++ b/lib/percpu_counter.c
@@ -77,6 +77,10 @@ void __percpu_counter_add(struct percpu_counter *fbc, s64 amount, s32 batch)
 	s64 count;
 
 	preempt_disable();
+
+	if (unlikely(!fbc->counters))
+		goto out;
+
 	count = __this_cpu_read(*fbc->counters) + amount;
 	if (count >= batch || count <= -batch) {
 		unsigned long flags;
@@ -87,6 +91,7 @@ void __percpu_counter_add(struct percpu_counter *fbc, s64 amount, s32 batch)
 	} else {
 		this_cpu_add(*fbc->counters, amount);
 	}
+out:
 	preempt_enable();
 }
 EXPORT_SYMBOL(__percpu_counter_add);
-- 
2.1.4