linux-kernel - Re: [PATCH v3] md: fix mddev uaf while iterating all

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f6628f78-a084-d3af-430c-d1765f88779e@huaweicloud.com>
Date: Wed, 5 Mar 2025 09:32:12 +0800
From: Yu Kuai <yukuai1@...weicloud.com>
To: Yu Kuai <yukuai1@...weicloud.com>, song@...nel.org, hare@...e.de,
 axboe@...nel.dk, logang@...tatee.com
Cc: linux-raid@...r.kernel.org, linux-kernel@...r.kernel.org,
 yi.zhang@...wei.com, yangerkun@...wei.com, hch@....de,
 guillaume@...infr.org, "yukuai (C)" <yukuai3@...wei.com>
Subject: Re: [PATCH v3] md: fix mddev uaf while iterating all_mddevs list

在 2025/02/20 20:43, Yu Kuai 写道:
> From: Yu Kuai <yukuai3@...wei.com>
> 
> While iterating all_mddevs list from md_notify_reboot() and md_exit(),
> list_for_each_entry_safe is used, and this can race with deletint the
> next mddev, causing UAF:
> 
> t1:
> spin_lock
> //list_for_each_entry_safe(mddev, n, ...)
>   mddev_get(mddev1)
>   // assume mddev2 is the next entry
>   spin_unlock
>              t2:
>              //remove mddev2
>              ...
>              mddev_free
>              spin_lock
>              list_del
>              spin_unlock
>              kfree(mddev2)
>   mddev_put(mddev1)
>   spin_lock
>   //continue dereference mddev2->all_mddevs
> 
> The old helper for_each_mddev() actually grab the reference of mddev2
> while holding the lock, to prevent from being freed. This problem can be
> fixed the same way, however, the code will be complex.
> 
> Hence switch to use list_for_each_entry, in this case mddev_put() can free
> the mddev1 and it's not safe as well. Refer to md_seq_show(), also factor
> out a helper mddev_put_locked() to fix this problem.
> 
> Cc: Christoph Hellwig <hch@....de>
> Fixes: f26514342255 ("md: stop using for_each_mddev in md_notify_reboot")
> Fixes: 16648bac862f ("md: stop using for_each_mddev in md_exit")
> Reported-by: Guillaume Morin <guillaume@...infr.org>
> Closes: https://lore.kernel.org/all/Z7Y0SURoA8xwg7vn@bender.morinfr.org/
> Signed-off-by: Yu Kuai <yukuai3@...wei.com>
> ---
>   drivers/md/md.c | 22 +++++++++++++---------
>   1 file changed, 13 insertions(+), 9 deletions(-)
> 
Applied to md-6.15
Thanks

> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 827646b3eb59..f501bc5f68f1 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -629,6 +629,12 @@ static void __mddev_put(struct mddev *mddev)
>   	queue_work(md_misc_wq, &mddev->del_work);
>   }
>   
> +static void mddev_put_locked(struct mddev *mddev)
> +{
> +	if (atomic_dec_and_test(&mddev->active))
> +		__mddev_put(mddev);
> +}
> +
>   void mddev_put(struct mddev *mddev)
>   {
>   	if (!atomic_dec_and_lock(&mddev->active, &all_mddevs_lock))
> @@ -8461,9 +8467,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
>   	if (mddev == list_last_entry(&all_mddevs, struct mddev, all_mddevs))
>   		status_unused(seq);
>   
> -	if (atomic_dec_and_test(&mddev->active))
> -		__mddev_put(mddev);
> -
> +	mddev_put_locked(mddev);
>   	return 0;
>   }
>   
> @@ -9895,11 +9899,11 @@ EXPORT_SYMBOL_GPL(rdev_clear_badblocks);
>   static int md_notify_reboot(struct notifier_block *this,
>   			    unsigned long code, void *x)
>   {
> -	struct mddev *mddev, *n;
> +	struct mddev *mddev;
>   	int need_delay = 0;
>   
>   	spin_lock(&all_mddevs_lock);
> -	list_for_each_entry_safe(mddev, n, &all_mddevs, all_mddevs) {
> +	list_for_each_entry(mddev, &all_mddevs, all_mddevs) {
>   		if (!mddev_get(mddev))
>   			continue;
>   		spin_unlock(&all_mddevs_lock);
> @@ -9911,8 +9915,8 @@ static int md_notify_reboot(struct notifier_block *this,
>   			mddev_unlock(mddev);
>   		}
>   		need_delay = 1;
> -		mddev_put(mddev);
>   		spin_lock(&all_mddevs_lock);
> +		mddev_put_locked(mddev);
>   	}
>   	spin_unlock(&all_mddevs_lock);
>   
> @@ -10245,7 +10249,7 @@ void md_autostart_arrays(int part)
>   
>   static __exit void md_exit(void)
>   {
> -	struct mddev *mddev, *n;
> +	struct mddev *mddev;
>   	int delay = 1;
>   
>   	unregister_blkdev(MD_MAJOR,"md");
> @@ -10266,7 +10270,7 @@ static __exit void md_exit(void)
>   	remove_proc_entry("mdstat", NULL);
>   
>   	spin_lock(&all_mddevs_lock);
> -	list_for_each_entry_safe(mddev, n, &all_mddevs, all_mddevs) {
> +	list_for_each_entry(mddev, &all_mddevs, all_mddevs) {
>   		if (!mddev_get(mddev))
>   			continue;
>   		spin_unlock(&all_mddevs_lock);
> @@ -10278,8 +10282,8 @@ static __exit void md_exit(void)
>   		 * the mddev for destruction by a workqueue, and the
>   		 * destroy_workqueue() below will wait for that to complete.
>   		 */
> -		mddev_put(mddev);
>   		spin_lock(&all_mddevs_lock);
> +		mddev_put_locked(mddev);
>   	}
>   	spin_unlock(&all_mddevs_lock);
>   
>