Yang Yingliang ad7ae9e2a3 workqueue: fix UAF in pwq_unbound_release_workfn() ... commit b42b0bddcb upstream. I got a UAF report when doing fuzz test: [ 152.880091][ T8030] ================================================================== [ 152.881240][ T8030] BUG: KASAN: use-after-free in pwq_unbound_release_workfn+0x50/0x190 [ 152.882442][ T8030] Read of size 4 at addr ffff88810d31bd00 by task kworker/3:2/8030 [ 152.883578][ T8030] [ 152.883932][ T8030] CPU: 3 PID: 8030 Comm: kworker/3:2 Not tainted 5.13.0+ #249 [ 152.885014][ T8030] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 152.886442][ T8030] Workqueue: events pwq_unbound_release_workfn [ 152.887358][ T8030] Call Trace: [ 152.887837][ T8030] dump_stack_lvl+0x75/0x9b [ 152.888525][ T8030] ? pwq_unbound_release_workfn+0x50/0x190 [ 152.889371][ T8030] print_address_description.constprop.10+0x48/0x70 [ 152.890326][ T8030] ? pwq_unbound_release_workfn+0x50/0x190 [ 152.891163][ T8030] ? pwq_unbound_release_workfn+0x50/0x190 [ 152.891999][ T8030] kasan_report.cold.15+0x82/0xdb [ 152.892740][ T8030] ? pwq_unbound_release_workfn+0x50/0x190 [ 152.893594][ T8030] __asan_load4+0x69/0x90 [ 152.894243][ T8030] pwq_unbound_release_workfn+0x50/0x190 [ 152.895057][ T8030] process_one_work+0x47b/0x890 [ 152.895778][ T8030] worker_thread+0x5c/0x790 [ 152.896439][ T8030] ? process_one_work+0x890/0x890 [ 152.897163][ T8030] kthread+0x223/0x250 [ 152.897747][ T8030] ? set_kthread_struct+0xb0/0xb0 [ 152.898471][ T8030] ret_from_fork+0x1f/0x30 [ 152.899114][ T8030] [ 152.899446][ T8030] Allocated by task 8884: [ 152.900084][ T8030] kasan_save_stack+0x21/0x50 [ 152.900769][ T8030] __kasan_kmalloc+0x88/0xb0 [ 152.901416][ T8030] __kmalloc+0x29c/0x460 [ 152.902014][ T8030] alloc_workqueue+0x111/0x8e0 [ 152.902690][ T8030] __btrfs_alloc_workqueue+0x11e/0x2a0 [ 152.903459][ T8030] btrfs_alloc_workqueue+0x6d/0x1d0 [ 152.904198][ T8030] scrub_workers_get+0x1e8/0x490 [ 152.904929][ T8030] btrfs_scrub_dev+0x1b9/0x9c0 [ 152.905599][ T8030] btrfs_ioctl+0x122c/0x4e50 [ 152.906247][ T8030] __x64_sys_ioctl+0x137/0x190 [ 152.906916][ T8030] do_syscall_64+0x34/0xb0 [ 152.907535][ T8030] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 152.908365][ T8030] [ 152.908688][ T8030] Freed by task 8884: [ 152.909243][ T8030] kasan_save_stack+0x21/0x50 [ 152.909893][ T8030] kasan_set_track+0x20/0x30 [ 152.910541][ T8030] kasan_set_free_info+0x24/0x40 [ 152.911265][ T8030] __kasan_slab_free+0xf7/0x140 [ 152.911964][ T8030] kfree+0x9e/0x3d0 [ 152.912501][ T8030] alloc_workqueue+0x7d7/0x8e0 [ 152.913182][ T8030] __btrfs_alloc_workqueue+0x11e/0x2a0 [ 152.913949][ T8030] btrfs_alloc_workqueue+0x6d/0x1d0 [ 152.914703][ T8030] scrub_workers_get+0x1e8/0x490 [ 152.915402][ T8030] btrfs_scrub_dev+0x1b9/0x9c0 [ 152.916077][ T8030] btrfs_ioctl+0x122c/0x4e50 [ 152.916729][ T8030] __x64_sys_ioctl+0x137/0x190 [ 152.917414][ T8030] do_syscall_64+0x34/0xb0 [ 152.918034][ T8030] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 152.918872][ T8030] [ 152.919203][ T8030] The buggy address belongs to the object at ffff88810d31bc00 [ 152.919203][ T8030] which belongs to the cache kmalloc-512 of size 512 [ 152.921155][ T8030] The buggy address is located 256 bytes inside of [ 152.921155][ T8030] 512-byte region [ffff88810d31bc00, ffff88810d31be00) [ 152.922993][ T8030] The buggy address belongs to the page: [ 152.923800][ T8030] page:ffffea000434c600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10d318 [ 152.925249][ T8030] head:ffffea000434c600 order:2 compound_mapcount:0 compound_pincount:0 [ 152.926399][ T8030] flags: 0x57ff00000010200(slab|head|node=1|zone=2|lastcpupid=0x7ff) [ 152.927515][ T8030] raw: 057ff00000010200 dead000000000100 dead000000000122 ffff888009c42c80 [ 152.928716][ T8030] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 152.929890][ T8030] page dumped because: kasan: bad access detected [ 152.930759][ T8030] [ 152.931076][ T8030] Memory state around the buggy address: [ 152.931851][ T8030] ffff88810d31bc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.932967][ T8030] ffff88810d31bc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.934068][ T8030] >ffff88810d31bd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.935189][ T8030] ^ [ 152.935763][ T8030] ffff88810d31bd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.936847][ T8030] ffff88810d31be00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 152.937940][ T8030] ================================================================== If apply_wqattrs_prepare() fails in alloc_workqueue(), it will call put_pwq() which invoke a work queue to call pwq_unbound_release_workfn() and use the 'wq'. The 'wq' allocated in alloc_workqueue() will be freed in error path when apply_wqattrs_prepare() fails. So it will lead a UAF. CPU0 CPU1 alloc_workqueue() alloc_and_link_pwqs() apply_wqattrs_prepare() fails apply_wqattrs_cleanup() schedule_work(&pwq->unbound_release_work) kfree(wq) worker_thread() pwq_unbound_release_workfn() <- trigger uaf here If apply_wqattrs_prepare() fails, the new pwq are not linked, it doesn't hold any reference to the 'wq', 'wq' is invalid to access in the worker, so add check pwq if linked to fix this. Fixes: 2d5f0764b5 ("workqueue: split apply_workqueue_attrs() into 3 stages") Cc: stable@vger.kernel.org # v4.2+ Reported-by: Hulk Robot <hulkci@huawei.com> Suggested-by: Lai Jiangshan <jiangshanlai@gmail.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com> Tested-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-08-04 12:22:14 +02:00
..
bpf	bpf: No need to simulate speculative domain for immediates	2021-06-10 12:43:53 +02:00
cgroup	cgroup1: don't allow '\n' in renaming	2021-06-16 11:53:02 +02:00
configs
debug	kdb: Make memory allocations more robust	2021-03-03 18:22:36 +01:00
events	perf: Fix data race between pin_count increment/decrement	2021-06-16 11:53:04 +02:00
gcov	gcov: add support for GCC 10.1	2020-09-23 10:46:32 +02:00
irq	genirq: Disable interrupts for force threaded handlers	2021-03-24 11:05:06 +01:00
livepatch	livepatch: Nullify obj->mod in klp_module_coming()'s error path	2019-10-07 18:55:09 +02:00
locking	rtmutex: Remove unused argument from rt_mutex_proxy_unlock()	2021-01-30 13:31:16 +01:00
power	PM: hibernate: remove the bogus call to get_gendisk() in software_resume()	2020-10-29 09:07:16 +01:00
printk	printk: fix deadlock when kernel panic	2021-03-03 18:22:55 +01:00
rcu	rcuperf: Fix cleanup path for invalid perf_type strings	2019-05-31 06:47:33 -07:00
sched	sched/fair: Fix CFS bandwidth hrtimer expiry type	2021-07-28 11:12:15 +02:00
time	posix-timers: Preserve return value in clock_adjtime32()	2021-05-22 10:57:22 +02:00
trace	tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.	2021-07-28 11:12:19 +02:00
.gitignore
acct.c	kernel/acct.c: fix the acct->needcheck check in check_free_space()	2018-01-10 09:31:17 +01:00
async.c	kernel/async.c: revert "async: simplify lowest_in_progress()"	2018-02-16 20:23:05 +01:00
audit.c	audit: fix a net reference leak in audit_list_rules_send()	2020-06-20 10:25:10 +02:00
audit.h	audit: fix a net reference leak in audit_list_rules_send()	2020-06-20 10:25:10 +02:00
audit_fsnotify.c
audit_tree.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
audit_watch.c	audit: CONFIG_CHANGE don't log internal bookkeeping as an event	2020-10-01 13:12:33 +02:00
auditfilter.c	audit: fix a net reference leak in audit_list_rules_send()	2020-06-20 10:25:10 +02:00
auditsc.c	audit: print empty EXECVE args	2019-12-01 09:14:03 +01:00
backtracetest.c
bounds.c	kbuild: fix kernel/bounds.c 'W=1' warning	2018-11-13 11:15:08 -08:00
capability.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
compat.c	make 'user_access_begin()' do 'access_ok()'	2020-06-20 10:24:58 +02:00
configs.c
context_tracking.c
cpu.c	cpu/hotplug: Cure the cpusets trainwreck	2021-07-20 16:17:46 +02:00
cpu_pm.c	kernel/cpu_pm: Fix uninitted local in cpu_pm	2020-06-20 10:25:19 +02:00
crash_core.c	kdump: write correct address of mem_section into vmcoreinfo	2018-01-17 09:45:27 +01:00
crash_dump.c
cred.c	memcg: account security cred as well to kmemcg	2020-01-09 10:17:54 +01:00
delayacct.c	delayacct: Use raw_spinlocks	2018-08-03 07:50:38 +02:00
dma.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
exec_domain.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
exit.c	don't dump the threads that had been already exiting when zapped.	2020-11-18 18:27:58 +01:00
extable.c	extable: Enable RCU if it is not watching in kernel_text_address()	2017-09-23 16:50:20 -04:00
fork.c	fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent	2020-11-10 10:29:06 +01:00
freezer.c
futex.c	mm, futex: fix shared futex pgoff on shmem huge page	2021-07-11 12:48:12 +02:00
groups.c	kernel: make groups_sort calling a responsibility group_info allocators	2017-12-20 10:10:18 +01:00
hung_task.c	kernel: hung_task.c: disable on suspend	2019-04-20 09:15:05 +02:00
irq_work.c
jump_label.c	sched/core: Fix cpu.max vs. cpuhotplug deadlock	2018-12-05 19:41:17 +01:00
kallsyms.c	kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the first symbol	2019-09-21 07:15:38 +02:00
kcmp.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c	kcov: ensure irq code sees a valid area	2018-08-03 07:50:22 +02:00
kexec.c
kexec_core.c	kexec: Allocate decrypted control pages for kdump if SME is enabled	2019-11-24 08:23:15 +01:00
kexec_file.c	kernel: kexec_file: fix error return code of kexec_calculate_store_digests()	2021-05-22 10:57:39 +02:00
kexec_internal.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
kmod.c	kmod: make request_module() return an error when autoloading is disabled	2020-04-24 08:00:44 +02:00
kprobes.c	kretprobe: Avoid re-registration of the same kretprobe earlier	2021-02-10 09:12:09 +01:00
ksysfs.c
kthread.c	kthread: prevent deadlock when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync()	2021-07-11 12:48:13 +02:00
latencytop.c
Makefile	elfcore: fix building with clang	2021-02-10 09:12:08 +01:00
memremap.c	mm, devm_memremap_pages: kill mapping "System RAM" support	2019-01-13 10:01:02 +01:00
module-internal.h
module.c	modules: inherit TAINT_PROPRIETARY_MODULE	2021-05-22 10:57:24 +02:00
module_signing.c
notifier.c	x86/mm: split vmalloc_sync_all()	2020-04-02 16:34:20 +02:00
nsproxy.c
padata.c	padata: purge get_cpu and reorder_via_wq from padata_do_serial	2020-05-27 16:43:05 +02:00
panic.c	panic: ensure preemption is disabled during panic()	2019-10-17 13:43:19 -07:00
params.c	kernel/params.c: improve STANDARD_PARAM_DEF readability	2017-10-03 17:54:26 -07:00
pid.c
pid_namespace.c	signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig	2019-07-31 07:28:21 +02:00
profile.c
ptrace.c	ptrace: make ptrace() fail if the tracee changed its pid unexpectedly	2021-05-26 11:46:58 +02:00
range.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
reboot.c	reboot: fix overflow parsing reboot cpu number	2020-11-18 18:28:02 +01:00
relay.c	kernel/relay.c: fix memleak on destroy relay channel	2020-08-26 10:29:54 +02:00
resource.c	resource: fix integer overflow at reallocation	2018-04-24 09:36:22 +02:00
seccomp.c	seccomp: Add missing return in non-void function	2021-03-03 18:22:53 +01:00
signal.c	signal: Extend exec_id to 64bits	2020-04-24 08:00:38 +02:00
smp.c	smp: Fix smp_call_function_single_async prototype	2021-05-22 10:57:35 +02:00
smpboot.c	kthread: Extract KTHREAD_IS_PER_CPU	2021-02-07 14:47:41 +01:00
smpboot.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
softirq.c	Mark HI and TASKLET softirq synchronous	2018-08-15 18:12:47 +02:00
stacktrace.c
stop_machine.c	stop_machine: Atomically queue and wake stopper threads	2018-09-05 09:26:36 +02:00
sys.c	kernel/sys.c: avoid copying possible padding bytes in copy_to_user	2020-10-01 13:12:30 +02:00
sys_ni.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
sysctl.c	kernel: sysctl: make drop_caches write-only	2020-01-04 13:59:57 +01:00
sysctl_binary.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
task_work.c	locking/barriers: Convert users of lockless_dereference() to READ_ONCE()	2017-12-25 14:26:21 +01:00
taskstats.c	taskstats: fix data-race	2020-01-09 10:17:53 +01:00
test_kprobes.c
torture.c
tracepoint.c	tracepoint: Do not fail unregistering a probe due to memory failure	2021-03-03 18:22:47 +01:00
tsacct.c
ucount.c
uid16.c	kernel: make groups_sort calling a responsibility group_info allocators	2017-12-20 10:10:18 +01:00
umh.c	usermodehelper: reset umask to default before executing user process	2020-10-14 09:51:10 +02:00
up.c	smp: Fix smp_call_function_single_async prototype	2021-05-22 10:57:35 +02:00
user-return-notifier.c
user.c
user_namespace.c	userns: move user access out of the mutex	2018-09-09 19:56:00 +02:00
utsname.c
utsname_sysctl.c	sys: don't hold uts_sem while accessing userspace memory	2018-09-09 19:56:00 +02:00
watchdog.c	watchdog/softlockup: Enforce that timestamp is valid on boot	2020-02-28 16:36:05 +01:00
watchdog_hld.c	watchdog: Mark watchdog touch functions as notrace	2018-09-05 09:26:42 +02:00
workqueue.c	workqueue: fix UAF in pwq_unbound_release_workfn()	2021-08-04 12:22:14 +02:00
workqueue_internal.h	Merge branch 'for-4.14-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq	2017-11-06 12:26:49 -08:00