Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module

[Donald Buczek]

On 4/21/23 19:32, Sergei Shtepa wrote:
> On 4/20/23 21:17, Sergei Shtepa wrote:
> > Subject:
> > Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module
> > From:
> > Sergei Shtepa <sergei.shtepa@xxxxxxxxx>
> > Date:
> > 4/20/23, 21:17
> >
> > To:
> > Donald Buczek <buczek@xxxxxxxxxxxxx>, axboe@xxxxxxxxx, hch@xxxxxxxxxxxxx, corbet@xxxxxxx, snitzer@xxxxxxxxxx
> > CC:
> > viro@xxxxxxxxxxxxxxxxxx, brauner@xxxxxxxxxx, willy@xxxxxxxxxxxxx, kch@xxxxxxxxxx, martin.petersen@xxxxxxxxxx, vkoul@xxxxxxxxxx, ming.lei@xxxxxxxxxx, gregkh@xxxxxxxxxxxxxxxxxxx, linux-block@xxxxxxxxxxxxxxx, linux-doc@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, linux-fsdevel@xxxxxxxxxxxxxxx
> >
> >
> >
> > On 4/20/23 16:44, Donald Buczek wrote:
> > > Subject:
> > > Re: [PATCH v3 03/11] documentation: Block Devices Snapshots Module
> > > From:
> > > Donald Buczek <buczek@xxxxxxxxxxxxx>
> > > Date:
> > > 4/20/23, 16:44
> > >
> > > To:
> > > Sergei Shtepa <sergei.shtepa@xxxxxxxxx>, axboe@xxxxxxxxx, hch@xxxxxxxxxxxxx, corbet@xxxxxxx, snitzer@xxxxxxxxxx
> > > CC:
> > > viro@xxxxxxxxxxxxxxxxxx, brauner@xxxxxxxxxx, willy@xxxxxxxxxxxxx, kch@xxxxxxxxxx, martin.petersen@xxxxxxxxxx, vkoul@xxxxxxxxxx, ming.lei@xxxxxxxxxx, gregkh@xxxxxxxxxxxxxxxxxxx, linux-block@xxxxxxxxxxxxxxx, linux-doc@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, linux-fsdevel@xxxxxxxxxxxxxxx
> > >
> > >
> > > On 4/19/23 21:42, Donald Buczek wrote:
> > > > Dear Sergei,
> > > >
> > > > On 4/19/23 15:05, Sergei Shtepa wrote:
> > > > > [...]
> > > > >
> > > > > Patches in attach and https://github.com/SergeiShtepa/linux/tree/blksnap-master
> > > > Thanks. I can confirm that this fixes the reported problem and I no longer can trigger the UAF. 😄
> > > >
> > > > Tested-Bny: Donald Buczek <buczek@xxxxxxxxxxxxx>
> > > >
> > > > Maybe you can add me to the cc list for v4 as I'm not subscribed to the lists.
> > >
> > > Sorry, found another one. Reproducer:
> > >
> > > =====
> > > #! /bin/bash
> > > set -xe
> > > modprobe blksnap
> > > test -e /scratch/local/test.dat || fallocate -l 1G /scratch/local/test.dat
> > > s=$(blksnap snapshot_create -d /dev/vdb)
> > > blksnap snapshot_appendstorage -i $s -f /scratch/local/test.dat
> > > blksnap snapshot_take -i $s
> > > s2=$(blksnap snapshot_create -d /dev/vdb)
> > > blksnap snapshot_destroy -i $s2
> > > blksnap snapshot_destroy -i $s
> > > =====
> > >
> > >
> > > [20382.402921] blksnap-snapshot: Snapshot ff1c54f1-3e8c-4c99-bb26-35e82dc1c9fa was created
> > > [20382.535933] blksnap-image: Create snapshot image device for original device [253:16]
> > > [20382.542405] blksnap-snapshot: Snapshot ff1c54f1-3e8c-4c99-bb26-35e82dc1c9fa was taken successfully
> > > [20382.572564] blksnap-snapshot: Snapshot 4b2d571d-9a24-419d-96c2-8d64a07c4966 was created
> > > [20382.600521] blksnap-snapshot: Destroy snapshot 4b2d571d-9a24-419d-96c2-8d64a07c4966
> > > [20382.602373] blksnap-snapshot: Release snapshot 4b2d571d-9a24-419d-96c2-8d64a07c4966
> > > [20382.722137] blksnap-snapshot: Destroy snapshot ff1c54f1-3e8c-4c99-bb26-35e82dc1c9fa
> > > [20382.724033] blksnap-snapshot: Release snapshot ff1c54f1-3e8c-4c99-bb26-35e82dc1c9fa
> > > [20382.725850] ==================================================================
> > > [20382.727641] BUG: KASAN: wild-memory-access in snapshot_free+0x73/0x170 [blksnap]
> > > [20382.729326] Write of size 8 at addr dead000000000108 by task blksnap/8297
> > > ...
> > Great! Thanks.
> >
> > There is no protection against re-adding a block device to the snapshot.
> > I'll take care of it.
>
> Hi!
>
> I think the fix turned out to be quite beautiful.
> Now you will get an error "Device or resource busy".
> Fix in attach and on github.
> Link: https://github.com/SergeiShtepa/linux/commit/43a5d3dd9858f092b734187b6a62ce75acaa47c7

I can confirm, that this fixes the problem.

    root@dose:~# blksnap snapshot_create -d /dev/vda -d /dev/vda
    fdcd3ee3-a25f-4c2a-93d7-2d951520e938
    Operation already in progress
    root@dose:~# echo $?
    1


Tested-By: Donald Buczek <buczek@xxxxxxxxxxxxx>

Best
  Donald

--
Donald Buczek
buczek@xxxxxxxxxxxxx
Tel: +49 30 8413 1433