2017-03-30 15:22:48

by kmeaw

[permalink] [raw]
Subject: [PATCH][RFC] dm raid: Fix NULL pointer dereference for raid1 without bitmap

From: Dmitry Bilunov <[email protected]>

4257e08 introduces a bitmap resize call during preresume phase. User
can create a DM device with "raid" target configured as raid1 with no
metadata devices to hold superblock/bitmap info. It can be achieved
using the following sequence:

truncate -s 32M /dev/shm/raid-test
LOOP=$(losetup --show -f /dev/shm/raid-test)
dmsetup create raid-test-linear0 --table "0 1024 linear $LOOP 0"
dmsetup create raid-test-linear1 --table "0 1024 linear $LOOP 1024"
dmsetup create raid-test --table "0 1024 raid raid1 1 2048 2 - /dev/mapper/raid-test-linear0 - /dev/mapper/raid-test-linear1"

It results in

Killed
[ 4029.110216] device-mapper: raid: Ignoring chunk size parameter for RAID 1
[ 4029.110217] device-mapper: raid: Choosing default region size of 4MiB
[ 4029.111349] md/raid1:mdX: active with 2 out of 2 mirrors
[ 4029.114770] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
[ 4029.114802] IP: bitmap_resize+0x25/0x7c0 [md_mod]
[ 4029.114816] PGD 0

[ 4029.115059] Hardware name: Aquarius Pro P30 S85 BUY-866/B85M-E, BIOS 2304 05/25/2015
[ 4029.115079] task: ffff88015cc29a80 task.stack: ffffc90001a5c000
[ 4029.115097] RIP: 0010:bitmap_resize+0x25/0x7c0 [md_mod]
[ 4029.115112] RSP: 0018:ffffc90001a5fb68 EFLAGS: 00010246
[ 4029.115127] RAX: 0000000000000005 RBX: 0000000000000000 RCX: 0000000000000000
[ 4029.115146] RDX: 0000000000000000 RSI: 0000000000000400 RDI: 0000000000000000
[ 4029.115166] RBP: ffffc90001a5fc28 R08: 0000000800000000 R09: 00000008ffffffff
[ 4029.115185] R10: ffffea0005661600 R11: ffff88015cc29a80 R12: ffff88021231f058
[ 4029.115204] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 4029.115223] FS: 00007fe73a6b4740(0000) GS:ffff88021ea80000(0000) knlGS:0000000000000000
[ 4029.115245] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4029.115261] CR2: 0000000000000030 CR3: 0000000159a74000 CR4: 00000000001426e0
[ 4029.115281] Call Trace:
[ 4029.115291] ? raid_iterate_devices+0x63/0x80 [dm_raid]
[ 4029.115309] ? dm_table_all_devices_attribute.isra.23+0x41/0x70 [dm_mod]
[ 4029.115329] ? dm_table_set_restrictions+0x225/0x2d0 [dm_mod]
[ 4029.115346] raid_preresume+0x81/0x2e0 [dm_raid]
[ 4029.115361] dm_table_resume_targets+0x47/0xe0 [dm_mod]
[ 4029.115378] dm_resume+0xa8/0xd0 [dm_mod]
[ 4029.115391] dev_suspend+0x123/0x250 [dm_mod]
[ 4029.115405] ? table_load+0x350/0x350 [dm_mod]
[ 4029.115419] ctl_ioctl+0x1c2/0x490 [dm_mod]
[ 4029.115433] dm_ctl_ioctl+0xe/0x20 [dm_mod]
[ 4029.115447] do_vfs_ioctl+0x8d/0x5a0
[ 4029.115459] ? ____fput+0x9/0x10
[ 4029.115470] ? task_work_run+0x79/0xa0
[ 4029.115481] SyS_ioctl+0x3c/0x70
[ 4029.115493] entry_SYSCALL_64_fastpath+0x13/0x94

Function raid_preresume takes an assumption that raid_set has a bitmap enabled.
Call to bitmap_load(&rs->md) inside __load_dirty_region_bitmap would return 0 even
if there is no bitmap present.

This patch avoids resizing an absent bitmap.

Signed-off-by: Dmitry Bilunov <[email protected]>
Signed-off-by: Andrey Smetanin <[email protected]>
---
drivers/md/dm-raid.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index f8564d63..67a5405e 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3727,6 +3727,7 @@ static int raid_preresume(struct dm_target *ti)

/* Resize bitmap to adjust to changed region size (aka MD bitmap chunksize) */
if (test_bit(RT_FLAG_RS_BITMAP_LOADED, &rs->runtime_flags) &&
+ mddev->bitmap &&
mddev->bitmap_info.chunksize != to_bytes(rs->requested_bitmap_chunk_sectors)) {
r = bitmap_resize(mddev->bitmap, mddev->dev_sectors,
to_bytes(rs->requested_bitmap_chunk_sectors), 0);
--
2.12.2


2017-03-30 19:31:08

by Heinz Mauelshagen

[permalink] [raw]
Subject: Re: [dm-devel] [PATCH][RFC] dm raid: Fix NULL pointer dereference for raid1 without bitmap


Acked-by: Heinz Mauelshagen <[email protected]>

This is the simplest way to solve the issue at hand
(bitmap_load() returns success with non-existing bitmap).

Heinz

On 03/30/2017 05:14 PM, [email protected] wrote:
> From: Dmitry Bilunov <[email protected]>
>
> 4257e08 introduces a bitmap resize call during preresume phase. User
> can create a DM device with "raid" target configured as raid1 with no
> metadata devices to hold superblock/bitmap info. It can be achieved
> using the following sequence:
>
> truncate -s 32M /dev/shm/raid-test
> LOOP=$(losetup --show -f /dev/shm/raid-test)
> dmsetup create raid-test-linear0 --table "0 1024 linear $LOOP 0"
> dmsetup create raid-test-linear1 --table "0 1024 linear $LOOP 1024"
> dmsetup create raid-test --table "0 1024 raid raid1 1 2048 2 - /dev/mapper/raid-test-linear0 - /dev/mapper/raid-test-linear1"
>
> It results in
>
> Killed
> [ 4029.110216] device-mapper: raid: Ignoring chunk size parameter for RAID 1
> [ 4029.110217] device-mapper: raid: Choosing default region size of 4MiB
> [ 4029.111349] md/raid1:mdX: active with 2 out of 2 mirrors
> [ 4029.114770] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
> [ 4029.114802] IP: bitmap_resize+0x25/0x7c0 [md_mod]
> [ 4029.114816] PGD 0
> …
> [ 4029.115059] Hardware name: Aquarius Pro P30 S85 BUY-866/B85M-E, BIOS 2304 05/25/2015
> [ 4029.115079] task: ffff88015cc29a80 task.stack: ffffc90001a5c000
> [ 4029.115097] RIP: 0010:bitmap_resize+0x25/0x7c0 [md_mod]
> [ 4029.115112] RSP: 0018:ffffc90001a5fb68 EFLAGS: 00010246
> [ 4029.115127] RAX: 0000000000000005 RBX: 0000000000000000 RCX: 0000000000000000
> [ 4029.115146] RDX: 0000000000000000 RSI: 0000000000000400 RDI: 0000000000000000
> [ 4029.115166] RBP: ffffc90001a5fc28 R08: 0000000800000000 R09: 00000008ffffffff
> [ 4029.115185] R10: ffffea0005661600 R11: ffff88015cc29a80 R12: ffff88021231f058
> [ 4029.115204] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> [ 4029.115223] FS: 00007fe73a6b4740(0000) GS:ffff88021ea80000(0000) knlGS:0000000000000000
> [ 4029.115245] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 4029.115261] CR2: 0000000000000030 CR3: 0000000159a74000 CR4: 00000000001426e0
> [ 4029.115281] Call Trace:
> [ 4029.115291] ? raid_iterate_devices+0x63/0x80 [dm_raid]
> [ 4029.115309] ? dm_table_all_devices_attribute.isra.23+0x41/0x70 [dm_mod]
> [ 4029.115329] ? dm_table_set_restrictions+0x225/0x2d0 [dm_mod]
> [ 4029.115346] raid_preresume+0x81/0x2e0 [dm_raid]
> [ 4029.115361] dm_table_resume_targets+0x47/0xe0 [dm_mod]
> [ 4029.115378] dm_resume+0xa8/0xd0 [dm_mod]
> [ 4029.115391] dev_suspend+0x123/0x250 [dm_mod]
> [ 4029.115405] ? table_load+0x350/0x350 [dm_mod]
> [ 4029.115419] ctl_ioctl+0x1c2/0x490 [dm_mod]
> [ 4029.115433] dm_ctl_ioctl+0xe/0x20 [dm_mod]
> [ 4029.115447] do_vfs_ioctl+0x8d/0x5a0
> [ 4029.115459] ? ____fput+0x9/0x10
> [ 4029.115470] ? task_work_run+0x79/0xa0
> [ 4029.115481] SyS_ioctl+0x3c/0x70
> [ 4029.115493] entry_SYSCALL_64_fastpath+0x13/0x94
>
> Function raid_preresume takes an assumption that raid_set has a bitmap enabled.
> Call to bitmap_load(&rs->md) inside __load_dirty_region_bitmap would return 0 even
> if there is no bitmap present.
>
> This patch avoids resizing an absent bitmap.
>
> Signed-off-by: Dmitry Bilunov <[email protected]>
> Signed-off-by: Andrey Smetanin <[email protected]>
> ---
> drivers/md/dm-raid.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
> index f8564d63..67a5405e 100644
> --- a/drivers/md/dm-raid.c
> +++ b/drivers/md/dm-raid.c
> @@ -3727,6 +3727,7 @@ static int raid_preresume(struct dm_target *ti)
>
> /* Resize bitmap to adjust to changed region size (aka MD bitmap chunksize) */
> if (test_bit(RT_FLAG_RS_BITMAP_LOADED, &rs->runtime_flags) &&
> + mddev->bitmap &&
> mddev->bitmap_info.chunksize != to_bytes(rs->requested_bitmap_chunk_sectors)) {
> r = bitmap_resize(mddev->bitmap, mddev->dev_sectors,
> to_bytes(rs->requested_bitmap_chunk_sectors), 0);