platform_kernel-5.15/kernel/trace
Yu Kuai 78acc7dbd8 blktrace: fix use after free for struct blk_trace
commit 30939293262eb433c960c4532a0d59c4073b2b84 upstream.

When tracing the whole disk, 'dropped' and 'msg' will be created
under 'q->debugfs_dir' and 'bt->dir' is NULL, thus blk_trace_free()
won't remove those files. What's worse, the following UAF can be
triggered because of accessing stale 'dropped' and 'msg':

==================================================================
BUG: KASAN: use-after-free in blk_dropped_read+0x89/0x100
Read of size 4 at addr ffff88816912f3d8 by task blktrace/1188

CPU: 27 PID: 1188 Comm: blktrace Not tainted 5.17.0-rc4-next-20220217+ #469
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-4
Call Trace:
 <TASK>
 dump_stack_lvl+0x34/0x44
 print_address_description.constprop.0.cold+0xab/0x381
 ? blk_dropped_read+0x89/0x100
 ? blk_dropped_read+0x89/0x100
 kasan_report.cold+0x83/0xdf
 ? blk_dropped_read+0x89/0x100
 kasan_check_range+0x140/0x1b0
 blk_dropped_read+0x89/0x100
 ? blk_create_buf_file_callback+0x20/0x20
 ? kmem_cache_free+0xa1/0x500
 ? do_sys_openat2+0x258/0x460
 full_proxy_read+0x8f/0xc0
 vfs_read+0xc6/0x260
 ksys_read+0xb9/0x150
 ? vfs_write+0x3d0/0x3d0
 ? fpregs_assert_state_consistent+0x55/0x60
 ? exit_to_user_mode_prepare+0x39/0x1e0
 do_syscall_64+0x35/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fbc080d92fd
Code: ce 20 00 00 75 10 b8 00 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 1
RSP: 002b:00007fbb95ff9cb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fbb95ff9dc0 RCX: 00007fbc080d92fd
RDX: 0000000000000100 RSI: 00007fbb95ff9cc0 RDI: 0000000000000045
RBP: 0000000000000045 R08: 0000000000406299 R09: 00000000fffffffd
R10: 000000000153afa0 R11: 0000000000000293 R12: 00007fbb780008c0
R13: 00007fbb78000938 R14: 0000000000608b30 R15: 00007fbb780029c8
 </TASK>

Allocated by task 1050:
 kasan_save_stack+0x1e/0x40
 __kasan_kmalloc+0x81/0xa0
 do_blk_trace_setup+0xcb/0x410
 __blk_trace_setup+0xac/0x130
 blk_trace_ioctl+0xe9/0x1c0
 blkdev_ioctl+0xf1/0x390
 __x64_sys_ioctl+0xa5/0xe0
 do_syscall_64+0x35/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Freed by task 1050:
 kasan_save_stack+0x1e/0x40
 kasan_set_track+0x21/0x30
 kasan_set_free_info+0x20/0x30
 __kasan_slab_free+0x103/0x180
 kfree+0x9a/0x4c0
 __blk_trace_remove+0x53/0x70
 blk_trace_ioctl+0x199/0x1c0
 blkdev_common_ioctl+0x5e9/0xb30
 blkdev_ioctl+0x1a5/0x390
 __x64_sys_ioctl+0xa5/0xe0
 do_syscall_64+0x35/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

The buggy address belongs to the object at ffff88816912f380
 which belongs to the cache kmalloc-96 of size 96
The buggy address is located 88 bytes inside of
 96-byte region [ffff88816912f380, ffff88816912f3e0)
The buggy address belongs to the page:
page:000000009a1b4e7c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0f
flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff)
raw: 0017ffffc0000200 ffffea00044f1100 dead000000000002 ffff88810004c780
raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88816912f280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
 ffff88816912f300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
>ffff88816912f380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
                                                    ^
 ffff88816912f400: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
 ffff88816912f480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
==================================================================

Fixes: c0ea57608b ("blktrace: remove debugfs file dentries from struct blk_trace")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20220228034354.4047385-1-yukuai3@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-03-08 19:12:43 +01:00
..
Kconfig tracing: Simplify the Kconfig dependency of FTRACE 2021-08-16 11:37:20 -04:00
Makefile tracing: Add a probe that attaches to trace events 2021-08-20 14:18:40 -04:00
blktrace.c blktrace: fix use after free for struct blk_trace 2022-03-08 19:12:43 +01:00
bpf_trace.c bpf: Remove config check to enable bpf support for branch records 2022-01-27 11:03:28 +01:00
bpf_trace.h bpf: Use dedicated bpf_trace_printk event instead of trace_printk() 2020-07-13 16:55:49 -07:00
error_report-traces.c tracing: add error_report_end trace point 2021-02-26 09:41:02 -08:00
fgraph.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
ftrace.c tracing: Disable "other" permission bits in the tracefs files 2021-11-18 19:16:15 +01:00
ftrace_internal.h
kprobe_event_gen_test.c
power-traces.c
preemptirq_delay_test.c kernel: trace: preemptirq_delay_test: add cpu affinity 2021-02-02 17:02:07 -05:00
ring_buffer.c ring-buffer: Protect ring_buffer_reset() from reentrancy 2021-11-18 19:16:03 +01:00
ring_buffer_benchmark.c sched,tracing: Convert to sched_set_fifo() 2020-07-29 11:43:53 +02:00
rpm-traces.c
synth_event_gen_test.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace.c tracing: Fix tp_printk option related with tp_printk_stop_on_boot 2022-02-23 12:03:19 +01:00
trace.h tracing: Fix pid filtering when triggers are attached 2021-12-01 09:04:43 +01:00
trace_benchmark.c tracing: Fix some typos in comments 2020-11-10 20:39:40 -05:00
trace_benchmark.h
trace_boot.c tracing: Fix missing trace_boot_init_histograms kstrdup NULL checks 2021-11-18 19:16:41 +01:00
trace_branch.c tracing: Merge irqflags + preempt counter. 2021-02-02 17:02:06 -05:00
trace_clock.c tracing: Do no increment trace_clock_global() by one 2021-06-18 09:10:00 -04:00
trace_dynevent.c tracing: Disable "other" permission bits in the tracefs files 2021-11-18 19:16:15 +01:00
trace_dynevent.h tracing: Add DYNAMIC flag for dynamic events 2021-08-18 18:10:32 -04:00
trace_entries.h trace: Add timerlat tracer 2021-06-25 19:57:24 -04:00
trace_eprobe.c tracing: Fix misspelling of "missing" 2021-10-29 09:54:14 -04:00
trace_event_perf.c ftrace: do CPU checking after preemption disabled 2021-11-18 19:16:20 +01:00
trace_events.c tracing: Check pid filtering when creating events 2021-12-01 09:04:55 +01:00
trace_events_filter.c tracing: Add ustring operation to filtering string pointers 2022-03-08 19:12:33 +01:00
trace_events_filter_test.h
trace_events_hist.c tracing: Propagate is_signed to expression 2022-02-16 12:56:08 +01:00
trace_events_inject.c tracing: Merge irqflags + preempt counter. 2021-02-02 17:02:06 -05:00
trace_events_synth.c tracing: Do not let synth_events block other dyn_event systems during create 2022-03-08 19:12:35 +01:00
trace_events_trigger.c tracing: Have traceon and traceoff trigger honor the instance 2022-03-02 11:48:03 +01:00
trace_export.c tracing: Fix some typos in comments 2020-11-10 20:39:40 -05:00
trace_functions.c tracing: Add "func_no_repeats" option for function tracing 2021-04-15 14:50:02 -04:00
trace_functions_graph.c tracing: Disable "other" permission bits in the tracefs files 2021-11-18 19:16:15 +01:00
trace_hwlat.c tracing: Disable "other" permission bits in the tracefs files 2021-11-18 19:16:15 +01:00
trace_irqsoff.c tracing: Merge irqflags + preempt counter. 2021-02-02 17:02:06 -05:00
trace_kdb.c kdb: Rename members of struct kdbtab_t 2021-07-27 17:05:06 +01:00
trace_kprobe.c tracing/kprobes: 'nmissed' not showed correctly for kretprobe 2022-01-27 11:05:09 +01:00
trace_kprobe_selftest.c
trace_kprobe_selftest.h
trace_mmiotrace.c tracing: Remove definition of DEBUG in trace_mmiotrace.c 2021-02-02 17:02:07 -05:00
trace_nop.c
trace_osnoise.c tracing/osnoise: Properly unhook events if start_per_cpu_kthreads() fails 2022-01-27 11:05:18 +01:00
trace_output.c tracing: Add migrate-disabled counter to tracing output. 2021-09-03 19:42:35 -04:00
trace_output.h ftrace: Add recording of functions that caused recursion 2020-11-06 08:42:26 -05:00
trace_preemptirq.c lockdep: fix order in trace_hardirqs_off_caller() 2020-09-14 10:08:07 +02:00
trace_printk.c tracing: Disable "other" permission bits in the tracefs files 2021-11-18 19:16:15 +01:00
trace_probe.c tracing/probes: check the return value of kstrndup() for pbuf 2022-03-08 19:12:38 +01:00
trace_probe.h tracing: Add a probe that attaches to trace events 2021-08-20 14:18:40 -04:00
trace_probe_tmpl.h tracing/probes: Have process_fetch_insn() take a void * instead of pt_regs 2021-08-19 09:09:03 -04:00
trace_recursion_record.c tracing: Disable "other" permission bits in the tracefs files 2021-11-18 19:16:15 +01:00
trace_sched_switch.c
trace_sched_wakeup.c tracing: Change variable type as bool for clean-up 2021-06-30 09:19:14 -04:00
trace_selftest.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_selftest_dynamic.c
trace_seq.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_stack.c tracing: Disable "other" permission bits in the tracefs files 2021-11-18 19:16:15 +01:00
trace_stat.c tracing: Disable "other" permission bits in the tracefs files 2021-11-18 19:16:15 +01:00
trace_stat.h
trace_synth.h tracing: synth events: increase max fields count 2021-09-08 15:29:16 -04:00
trace_syscalls.c tracing: Have syscall trace events use trace_event_buffer_lock_reserve() 2022-01-27 11:05:09 +01:00
trace_uprobe.c tracing/uprobes: Check the return value of kstrdup() for tu->filename 2022-03-08 19:12:38 +01:00
tracing_map.c tracing: Fix a kmemleak false positive in tracing_map 2021-12-17 10:30:16 +01:00
tracing_map.h tracing: Fix some typos in comments 2020-11-10 20:39:40 -05:00