linux-kernel - Re: [PATCH] block: Fix use-after-free issue accessing struct io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 11 Mar 2020 06:59:34 -0600
From:   Jens Axboe <axboe@...nel.dk>
To:     Sahitya Tummala <stummala@...eaurora.org>,
        linux-block@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, Pradeep P V K <ppvk@...eaurora.org>
Subject: Re: [PATCH] block: Fix use-after-free issue accessing struct io_cq

On 3/11/20 4:37 AM, Sahitya Tummala wrote:
> There is a potential race between ioc_release_fn() and
> ioc_clear_queue() as shown below, due to which below kernel
> crash is observed. It also can result into use-after-free
> issue.
> 
> context#1:				context#2:
> ioc_release_fn()			__ioc_clear_queue() gets the same icq
> ->spin_lock(&ioc->lock);		->spin_lock(&ioc->lock);
> ->ioc_destroy_icq(icq);
>   ->list_del_init(&icq->q_node);
>   ->call_rcu(&icq->__rcu_head,
>   	icq_free_icq_rcu);
> ->spin_unlock(&ioc->lock);
> 					->ioc_destroy_icq(icq);
> 					  ->hlist_del_init(&icq->ioc_node);
> 					  This results into below crash as this memory
> 					  is now used by icq->__rcu_head in context#1.
> 					  There is a chance that icq could be free'd
> 					  as well.
> 
> 22150.386550:   <6> Unable to handle kernel write to read-only memory
> at virtual address ffffffaa8d31ca50

Fix looks good to me, applied.

-- 
Jens Axboe