[BUG] dm-stats: null-ptr-deref in dm_stat_free on stats alloc failure

[Junzhe Yu]

Hello,

I am reporting a null-pointer dereference in device-mapper dm-stats when
@stats_create fails part-way through per-CPU buffer allocation.

Summary
=======

dm_stats_create() allocates per-CPU stat buffers in a loop. On mid-loop
ENOMEM it jumps to out: and calls dm_stat_free(). dm_stat_free() then
dereferences s->stat_percpu[cpu] without a NULL check, including for CPUs
that never received a successful allocation (still NULL from zero-init).

The crash is a KASAN null-ptr-deref / general protection fault in
dm_stat_free() at drivers/md/dm-stats.c, reached via DM_TARGET_MSG
@stats_create.

Affected
========

- Confirmed on Linux 6.6.145 (KASAN + CONFIG_FAIL_PAGE_ALLOC); also
  reproduced earlier on 6.6.144
- Originally found on Linux 6.6.0 via syzkaller
- Files: drivers/md/dm-stats.c
- Config: CONFIG_DM=y; CONFIG_FAIL_PAGE_ALLOC=y makes the PoC deterministic

Root cause (brief)
==================

1. dm_stats_create() does for_each_possible_cpu(): dm_kvzalloc(...);
   on failure: r = -ENOMEM; goto out;
2. out: calls dm_stat_free(&s->rcu_head)
3. dm_stat_free() does for_each_possible_cpu():
     dm_kvfree(s->stat_percpu[cpu][0].histogram, ...);
   with no NULL guard — NPD when that CPU never allocated.

Needs enough CPUs that fail_page_alloc can fail after some CPUs succeed
(guest with >= 4 vCPUs). Partial init on the error path is not cleaned up
safely.

Crash excerpt (6.6.145 KASAN)
=============================

general protection fault ... KASAN: null-ptr-deref in range [0x60-0x67]
CPU: ... Comm: repro Not tainted 6.6.145 #1
RIP: 0010:dm_stat_free+0x12c/0x360
Call Trace:
  dm_stats_message
  target_message
  ctl_ioctl
  dm_ctl_ioctl
Kernel panic - not syncing: Fatal exception

Full excerpt is in crash_excerpt.txt in the attachment.

Impact
======

Privileged local DoS (CAP_SYS_ADMIN required for /dev/mapper/control).
NULL deref, not UAF — practical impact is denial of service under memory
pressure / fault injection on the @stats_create path.

Reproducer
==========

Attached: dm-stat-free-null-deref-repro.tar.gz

VM-only (do not run on a production host). Minimized C PoC: create a
zero-target DM device, resume, send @stats_create - 1024 while
fail_page_alloc is armed (fallback: memory hog). Guest needs >= 4 vCPUs.

Quick path (Docker + KVM):

  tar xzf dm-stat-free-null-deref-repro.tar.gz
  cd <extracted-dir>
  docker build -t dm-stat-free-null-deref -f Dockerfile .
  mkdir -p artifacts
  docker run --rm --privileged --device=/dev/kvm --network=host \
    -v "$PWD/artifacts:/artifacts" \
    -e OUTPUT_DIR=/artifacts \
    -e VM_MEMORY_MB=512 \
    -e VM_CPUS=4 \
    dm-stat-free-null-deref

Expected shortly after the PoC runs (first run also builds the kernel):

  KASAN: null-ptr-deref ... dm_stat_free
  Kernel panic - not syncing: Fatal exception

I am happy to test patches. Please let me know if you need more detail.

Thanks,
Yu Junzhe
FuzzAnything <fuzzanything@xxxxxxxxx>

Attachment: dm-stat-free-null-deref-repro.tar.gz
Description: GNU Zip compressed data