• Jason Cai (Xiang Feng)'s avatar
    dm thin: add sanity checks to thin-pool and external snapshot creation · 70de2cbd
    Jason Cai (Xiang Feng) authored
    Invoking dm_get_device() twice on the same device path with different
    modes is dangerous.  Because in that case, upgrade_mode() will alloc a
    new 'dm_dev' and free the old one, which may be referenced by a previous
    caller.  Dereferencing the dangling pointer will trigger kernel NULL
    pointer dereference.
    
    The following two cases can reproduce this issue.  Actually, they are
    invalid setups that must be disallowed, e.g.:
    
    1. Creating a thin-pool with read_only mode, and the same device as
    both metadata and data.
    
    dmsetup create thinp --table \
        "0 41943040 thin-pool /dev/vdb /dev/vdb 128 0 1 read_only"
    
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
    ...
    Call Trace:
     new_read+0xfb/0x110 [dm_bufio]
     dm_bm_read_lock+0x43/0x190 [dm_persistent_data]
     ? kmem_cache_alloc_trace+0x15c/0x1e0
     __create_persistent_data_objects+0x65/0x3e0 [dm_thin_pool]
     dm_pool_metadata_open+0x8c/0xf0 [dm_thin_pool]
     pool_ctr.cold.79+0x213/0x913 [dm_thin_pool]
     ? realloc_argv+0x50/0x70 [dm_mod]
     dm_table_add_target+0x14e/0x330 [dm_mod]
     table_load+0x122/0x2e0 [dm_mod]
     ? dev_status+0x40/0x40 [dm_mod]
     ctl_ioctl+0x1aa/0x3e0 [dm_mod]
     dm_ctl_ioctl+0xa/0x10 [dm_mod]
     do_vfs_ioctl+0xa2/0x600
     ? handle_mm_fault+0xda/0x200
     ? __do_page_fault+0x26c/0x4f0
     ksys_ioctl+0x60/0x90
     __x64_sys_ioctl+0x16/0x20
     do_syscall_64+0x55/0x150
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    2. Creating a external snapshot using the same thin-pool device.
    
    dmsetup create thinp --table \
        "0 41943040 thin-pool /dev/vdc /dev/vdb 128 0 2 ignore_discard"
    dmsetup message /dev/mapper/thinp 0 "create_thin 0"
    dmsetup create snap --table \
                "0 204800 thin /dev/mapper/thinp 0 /dev/mapper/thinp"
    
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
    ...
    Call Trace:
    ? __alloc_pages_nodemask+0x13c/0x2e0
    retrieve_status+0xa5/0x1f0 [dm_mod]
    ? dm_get_live_or_inactive_table.isra.7+0x20/0x20 [dm_mod]
     table_status+0x61/0xa0 [dm_mod]
     ctl_ioctl+0x1aa/0x3e0 [dm_mod]
     dm_ctl_ioctl+0xa/0x10 [dm_mod]
     do_vfs_ioctl+0xa2/0x600
     ksys_ioctl+0x60/0x90
     ? ksys_write+0x4f/0xb0
     __x64_sys_ioctl+0x16/0x20
     do_syscall_64+0x55/0x150
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    Signed-off-by: default avatarJason Cai (Xiang Feng) <jason.cai@linux.alibaba.com>
    Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
    70de2cbd
dm-thin.c 112 KB