• Ignat Korchagin's avatar
    dm crypt: do not call bio_endio() from the dm-crypt tasklet · 8e14f610
    Ignat Korchagin authored
    Sometimes, when dm-crypt executes decryption in a tasklet, we may get
    "BUG: KASAN: use-after-free in tasklet_action_common.constprop..."
    with a kasan-enabled kernel.
    
    When the decryption fully completes in the tasklet, dm-crypt will call
    bio_endio(), which in turn will call clone_endio() from dm.c core code. That
    function frees the resources associated with the bio, including per bio private
    structures. For dm-crypt it will free the current struct dm_crypt_io, which
    contains our tasklet object, causing use-after-free, when the tasklet is being
    dequeued by the kernel.
    
    To avoid this, do not call bio_endio() from the current tasklet context, but
    delay its execution to the dm-crypt IO workqueue.
    
    Fixes: 39d42fa9 ("dm crypt: add flags to optionally bypass kcryptd workqueues")
    Cc: <stable@vger.kernel.org> # v5.9+
    Signed-off-by: default avatarIgnat Korchagin <ignat@cloudflare.com>
    Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
    8e14f610
dm-crypt.c 91.9 KB