Dear Sergei, On 4/19/23 15:05, Sergei Shtepa wrote:
On 4/18/23 16:48, Donald Buczek wrote:Subject: Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module From: Donald Buczek <buczek@xxxxxxxxxxxxx> Date: 4/18/23, 16:48 To: Sergei Shtepa <sergei.shtepa@xxxxxxxxx>, axboe@xxxxxxxxx, hch@xxxxxxxxxxxxx, corbet@xxxxxxx, snitzer@xxxxxxxxxx CC: viro@xxxxxxxxxxxxxxxxxx, brauner@xxxxxxxxxx, willy@xxxxxxxxxxxxx, kch@xxxxxxxxxx, martin.petersen@xxxxxxxxxx, vkoul@xxxxxxxxxx, ming.lei@xxxxxxxxxx, gregkh@xxxxxxxxxxxxxxxxxxx, linux-block@xxxxxxxxxxxxxxx, linux-doc@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, linux-fsdevel@xxxxxxxxxxxxxxx On 4/18/23 12:31, Sergei Shtepa wrote:On 4/14/23 14:34, Sergei Shtepa wrote:Subject: Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module From: Sergei Shtepa <sergei.shtepa@xxxxxxxxx> Date: 4/14/23, 14:34 To: Donald Buczek <buczek@xxxxxxxxxxxxx>, axboe@xxxxxxxxx, hch@xxxxxxxxxxxxx, corbet@xxxxxxx, snitzer@xxxxxxxxxx CC: viro@xxxxxxxxxxxxxxxxxx, brauner@xxxxxxxxxx, willy@xxxxxxxxxxxxx, kch@xxxxxxxxxx, martin.petersen@xxxxxxxxxx, vkoul@xxxxxxxxxx, ming.lei@xxxxxxxxxx, gregkh@xxxxxxxxxxxxxxxxxxx, linux-block@xxxxxxxxxxxxxxx, linux-doc@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, linux-fsdevel@xxxxxxxxxxxxxxx On 4/12/23 21:38, Donald Buczek wrote:Subject: Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module From: Donald Buczek <buczek@xxxxxxxxxxxxx> Date: 4/12/23, 21:38 To: Sergei Shtepa <sergei.shtepa@xxxxxxxxx>, axboe@xxxxxxxxx, hch@xxxxxxxxxxxxx, corbet@xxxxxxx, snitzer@xxxxxxxxxx CC: viro@xxxxxxxxxxxxxxxxxx, brauner@xxxxxxxxxx, willy@xxxxxxxxxxxxx, kch@xxxxxxxxxx, martin.petersen@xxxxxxxxxx, vkoul@xxxxxxxxxx, ming.lei@xxxxxxxxxx, gregkh@xxxxxxxxxxxxxxxxxxx, linux-block@xxxxxxxxxxxxxxx, linux-doc@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, linux-fsdevel@xxxxxxxxxxxxxxx I think, you can trigger all kind of user-after-free when userspace deletes a snapshot image or the snapshot image and the tracker while the disk device snapshot image is kept alive (mounted or just opened) and doing I/O. Here is what I did to provoke that: root@dose:~# s=$(blksnap snapshot_create -d /dev/vdb) root@dose:~# blksnap snapshot_appendstorage -i $s -f /scratch/local/test.dat device path: '/dev/block/253:2' allocate range: ofs=11264624 cnt=2097152 root@dose:~# blksnap snapshot_take -i $s root@dose:~# mount /dev/blksnap-image_253\:16 /mnt root@dose:~# dd if=/dev/zero of=/mnt/x.x & [1] 2514 root@dose:~# blksnap snapshot_destroy -i $s dd: writing to '/mnt/x.x': No space left on device 1996041+0 records in 1996040+0 records out 1021972480 bytes (1.0 GB, 975 MiB) copied, 8.48923 s, 120 MB/s [1]+ Exit 1 dd if=/dev/zero of=/mnt/x.xThanks! I am very glad that the blksnap tool turned out to be useful in the review. This snapshot deletion scenario is not the most typical, but of course it is quite possible. I will need to solve this problem and add such a scenario to the test suite.Hi! I have redesign the logic of ownership of the diff_area structure. See patch in attach or commit. Link: https://github.com/SergeiShtepa/linux/commit/7e927c381dcd2b2293be8315897a224d111b6f88 A test script for such a scenario has been added. Link: https://github.com/veeam/blksnap/commit/fd0559dfedf094901d08bbf185fed288f0156433 I will be glad of any feedback.Great, Thanks! However, there are two leftover calls to diff_area_free() with its old prototype: CC [M] drivers/block/blksnap/diff_area.o drivers/block/blksnap/diff_area.c: In function ‘diff_area_new’: drivers/block/blksnap/diff_area.c:283:18: error: passing argument 1 of ‘diff_area_free’ from incompatible pointer type [-Werror=incompatible-pointer-types] 283 | diff_area_free(diff_area); | ^~~~~~~~~ | | | struct diff_area * drivers/block/blksnap/diff_area.c:110:34: note: expected ‘struct kref *’ but argument is of type ‘struct diff_area *’ 110 | void diff_area_free(struct kref *kref) | ~~~~~~~~~~~~~^~~~ cc1: some warnings being treated as errors make[4]: *** [scripts/Makefile.build:252: drivers/block/blksnap/diff_area.o] Error 1 make[3]: *** [scripts/Makefile.build:494: drivers/block/blksnap] Error 2 make[2]: *** [scripts/Makefile.build:494: drivers/block] Error 2 make[1]: *** [scripts/Makefile.build:494: drivers] Error 2 make: *** [Makefile:2025: .] Error 2 The other one: buczek@dose:/scratch/local/linux (blksnap-test)$ make drivers/block/blksnap/tracker.o CALL scripts/checksyscalls.sh DESCEND objtool INSTALL libsubcmd_headers CC [M] drivers/block/blksnap/tracker.o drivers/block/blksnap/tracker.c: In function ‘tracker_free’: drivers/block/blksnap/tracker.c:26:25: error: passing argument 1 of ‘diff_area_free’ from incompatible pointer type [-Werror=incompatible-pointer-types] 26 | diff_area_free(tracker->diff_area); | ~~~~~~~^~~~~~~~~~~ | | | struct diff_area * In file included from drivers/block/blksnap/tracker.c:12: drivers/block/blksnap/diff_area.h:116:34: note: expected ‘struct kref *’ but argument is of type ‘struct diff_area *’ 116 | void diff_area_free(struct kref *kref); | ~~~~~~~~~~~~~^~~~ cc1: some warnings being treated as errors make[4]: *** [scripts/Makefile.build:252: drivers/block/blksnap/tracker.o] Error 1 make[3]: *** [scripts/Makefile.build:494: drivers/block/blksnap] Error 2 make[2]: *** [scripts/Makefile.build:494: drivers/block] Error 2 make[1]: *** [scripts/Makefile.build:494: drivers] Error 2 make: *** [Makefile:2025: .] Error 2 Am I missing something?Thanks! It seems to me that I missed something. The biggest mystery for me is why I was able to build and test the kernel. I think it's some kind of incremental build effect. I was only able to see the problem after 'make clean'. Patches in attach and https://github.com/SergeiShtepa/linux/tree/blksnap-master
Thanks. I can confirm that this fixes the reported problem and I no longer can trigger the UAF. :-) Tested-Bny: Donald Buczek <buczek@xxxxxxxxxxxxx> Maybe you can add me to the cc list for v4 as I'm not subscribed to the lists. Best Donald -- Donald Buczek buczek@xxxxxxxxxxxxx Tel: +49 30 8413 1433
