【olk-5.10】ext4: fix an use-after-free issue about data=journal writeback mode

## 问题现象：
[  375.447043] EXT4-fs: Warning: mounting with data=journal disables delayed allocation and O_DIRECT support!
[  375.463301] EXT4-fs (pmem1): mounted filesystem with journalled data mode. Opts: data=journal
[  399.337631] [ext4_writepage] start to sleep 10s
[  402.345562] [ext4_setattr] Set size 0
[  409.354765] [ext4_writepage] end sleep, get len 0
[  409.356520] [__ext4_journalled_writepage] get buffers ffff8881073623f0, count 1
[  409.357610] [__ext4_journalled_writepage] unlock page, start to sleep 1s
[  409.357713] [jbd2_journal_invalidatepage] free buffer_head
[  410.358800] [__ext4_journalled_writepage] end sleep
[  410.359851] ==================================================================
[  410.361809] BUG: KASAN: use-after-free in ext4_writepage+0xd9c/0x1600
[  410.363476] Read of size 8 at addr ffff888107362410 by task kworker/u64:4/292
[  410.365247]
[  410.365607] CPU: 1 PID: 292 Comm: kworker/u64:4 Not tainted 4.19.90-00002-gd78c2ce71c58-dirty #241
[  410.367803] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
[  410.371109] Workqueue: writeback wb_workfn (flush-259:1)
[  410.372440] Call Trace:
[  410.373100]  dump_stack+0xec/0x13f
[  410.374017]  print_address_description+0x9e/0x350
[  410.375194]  kasan_report.cold+0x236/0x2aa
[  410.376331]  ? ext4_writepage+0xd9c/0x1600
[  410.377377]  __asan_load8+0x6a/0xf0
[  410.378254]  ext4_writepage+0xd9c/0x1600
[  410.379234]  ? ext4_writepages+0x1f00/0x1f00
[  410.380294]  ? __mod_lruvec_state+0xbb/0x270
[  410.381337]  ? percpu_counter_add_batch+0x2e/0xd0
[  410.382512]  __writepage+0x3f/0xb0
[  410.383389]  write_cache_pages+0x3e0/0x950
[  410.384379]  ? wait_for_stable_page+0x130/0x130
[  410.385488]  ? __mod_lruvec_state+0xbb/0x270
[  410.386537]  ? write_one_page+0x630/0x630
[  410.387530]  ? find_get_pages_range_tag+0x9a7/0xab0
[  410.388701]  ? find_get_entries_tag+0xa30/0xa30
[  410.389790]  ? mark_buffer_write_io_error+0xe0/0xe0
[  410.391074]  generic_writepages+0xc5/0x140
[  410.392086]  ? write_cache_pages+0x950/0x950
[  410.393140]  ? pagevec_lookup_range_tag+0x3f/0x50
[  410.394288]  ? write_cache_pages+0x89e/0x950
[  410.395323]  ? wait_for_stable_page+0x130/0x130
[  410.396386]  ext4_writepages+0x24c/0x1f00
[  410.397388]  ? write_one_page+0x630/0x630
[  410.398381]  ? select_idle_sibling+0x2b/0xa30
[  410.399418]  ? ext4_iomap_end+0x400/0x400
[  410.400387]  ? select_task_rq_fair+0x862/0x19e0
[  410.401509]  ? blk_finish_plug+0x2c/0x70
[  410.402489]  ? generic_writepages+0xda/0x140
[  410.403526]  ? write_cache_pages+0x950/0x950
[  410.404569]  ? kvm_sched_clock_read+0x25/0x40
[  410.405652]  ? __x2apic_send_IPI_dest+0x30/0x50
[  410.406756]  ? x2apic_send_IPI+0x53/0x60
[  410.407722]  ? do_writepages+0x47/0x110
[  410.408689]  ? blkdev_writepages+0x12/0x20
[  410.409747]  do_writepages+0x47/0x110
[  410.410688]  __writeback_single_inode+0x7a/0x710
[  410.411854]  ? wbc_attach_and_unlock_inode+0x272/0x3b0
[  410.413201]  writeback_sb_inodes+0x3a3/0x940
[  410.414268]  ? wbc_detach_inode+0x3a0/0x3a0
[  410.415345]  ? vsnprintf+0x159/0xbc0
[  410.416243]  __writeback_inodes_wb+0xc8/0x170
[  410.417338]  wb_writeback+0x5ce/0x690
[  410.418247]  ? set_worker_desc+0x14f/0x180
[  410.419252]  ? __writeback_inodes_wb+0x170/0x170
[  410.421079]  ? find_next_bit+0x2d/0xe0
[  410.422438]  ? cpumask_next+0x2f/0x40
[  410.423732]  wb_workfn+0x707/0x920
[  410.425075]  ? kvm_sched_clock_read+0x25/0x40
[  410.426579]  ? inode_wait_for_writeback+0x60/0x60
[  410.427457]  ? __migrate_task+0x100/0x100
[  410.428121]  ? kasan_check_read+0x1d/0x30
[  410.428679]  ? read_word_at_a_time+0x16/0x30
[  410.429390]  process_one_work+0x402/0xa40
[  410.430086]  worker_thread+0x32f/0x8a0
[  410.430606]  kthread+0x1d1/0x250
[  410.431179]  ? rescuer_thread+0x7d0/0x7d0
[  410.431755]  ? kthread_flush_work+0x260/0x260
[  410.432463]  ret_from_fork+0x1f/0x30
[  410.433085]
[  410.433301] Allocated by task 1034:
[  410.433771]  kasan_kmalloc+0x149/0x220
[  410.434412]  kasan_slab_alloc+0x12/0x20
[  410.435076]  kmem_cache_alloc+0x134/0x3a0
[  410.435638]  alloc_buffer_head+0x24/0x90
[  410.436305]  alloc_page_buffers+0xfb/0x270
[  410.436845]  create_empty_buffers+0x27/0x400
[  410.437552]  create_page_buffers+0xad/0x110
[  410.438242]  __block_write_begin_int+0x12e/0xcb0
[  410.438853]  block_page_mkwrite+0x117/0x1e0
[  410.439560]  ext4_page_mkwrite+0x54e/0xcf0
[  410.440230]  do_page_mkwrite+0xc0/0x250
[  410.440751]  __handle_mm_fault+0x1660/0x21e0
[  410.441453]  handle_mm_fault+0x287/0x430
[  410.442078]  __do_page_fault+0x46a/0xb00
[  410.442600]  do_page_fault+0x65/0x2d0
[  410.443211]  do_async_page_fault+0x2e/0x1a0
[  410.443785]  async_page_fault+0x1e/0x30
[  410.444422]
[  410.444634] Freed by task 1038:
[  410.445190]  __kasan_slab_free+0x184/0x360
[  410.445761]  kasan_slab_free+0x12/0x20
[  410.446389]  kmem_cache_free+0xa6/0x330
[  410.446969]  free_buffer_head+0x36/0x90
[  410.447550]  try_to_free_buffers+0x189/0x2b0
[  410.448235]  jbd2_journal_invalidatepage+0x7b6/0x8a0
[  410.449009]  __ext4_journalled_invalidatepage+0xb4/0x180
[  410.449772]  ext4_journalled_invalidatepage+0x12/0x30
[  410.450571]  truncate_cleanup_page+0x7e/0x170
[  410.451267]  truncate_inode_page+0x3d/0xb0
[  410.451811]  truncate_inode_pages_range+0x6b3/0x12a0
[  410.453596]  truncate_pagecache+0x61/0x90
[  410.454330]  ext4_setattr+0x1032/0x1730
[  410.454842]  notify_change+0x461/0x890
[  410.455471]  do_truncate+0xf7/0x1c0
[  410.456065]  do_sys_ftruncate+0x214/0x2d0
[  410.456621]  __x64_sys_ftruncate+0x39/0x50
[  410.457290]  do_syscall_64+0xad/0x4d0
[  410.457781]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  410.458584]
[  410.458790] The buggy address belongs to the object at ffff8881073623f0
[  410.458790]  which belongs to the cache buffer_head of size 104
[  410.460689] The buggy address is located 32 bytes inside of
[  410.460689]  104-byte region [ffff8881073623f0, ffff888107362458)
[  410.462450] The buggy address belongs to the page:
[  410.463195] page:ffffea00041cd880 count:1 mapcount:0 mapping:ffff88810011ec00 index:0xffff8881073622a0 compound_mapcount: 0
[  410.464751] flags: 0x2fffff80008100(slab|head)
[  410.465475] raw: 002fffff80008100 dead000000000100 dead000000000200 ffff88810011ec00
[  410.466601] raw: ffff8881073622a0 000000008030002b 00000001ffffffff 0000000000000000
[  410.467764] page dumped because: kasan: bad access detected
[  410.468614]
[  410.468818] Memory state around the buggy address:
[  410.469593]  ffff888107362300: fb fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00
[  410.470677]  ffff888107362380: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fb fb
[  410.471753] >ffff888107362400: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
[  410.472822]                          ^
[  410.473456]  ffff888107362480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  410.474528]  ffff888107362500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  410.475623] ==================================================================
[  410.476780] Disabling lock debugging due to kernel taint

## 必现方法：
1. 首先修改内核，在以下函数位置增加时延：
```
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1974,6 +1974,7 @@ static int bput_one(handle_t *handle, struct buffer_head *bh)
        return 0;
 }

+#include <linux/delay.h>
 static int __ext4_journalled_writepage(struct page *page,
                                       unsigned int len)
 {
@@ -2009,6 +2013,11 @@ static int __ext4_journalled_writepage(struct page *page,
         */
        get_page(page);
        unlock_page(page);
+       if (inode->i_ino == 12) {
+               printk("[%s] unlock page, start to sleep 1s\n", __func__);
+               mdelay(1 * 1000);
+               printk("[%s] end sleep\n", __func__);
+       }

handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE,
                                    ext4_writepage_trans_blocks(inode));
@@ -2134,12 +2143,18 @@ static int ext4_writepage(struct page *page,
        }

trace_ext4_writepage(page);
+       if (inode->i_ino == 12) {
+               printk("[%s] start to sleep 10s\n", __func__);
+               mdelay(10 * 1000);
+       }
        size = i_size_read(inode);
        if (page->index == size >> PAGE_SHIFT)
                len = size & ~PAGE_MASK;
        else
                len = PAGE_SIZE;

+       if (inode->i_ino == 12)
+               printk("[%s] end sleep, get len %u\n", __func__, len);
        page_bufs = page_buffers(page);
```
2. 准备文件系统
```
mkfs.ext4 /dev/pmem1
mount /dev/pmem1 /mnt
dd if=/dev/zero of=/mnt/foo bs=4K count=1  #一般情况下新创建的foo文件inode号为12，若不是前面内核过滤条件需要进行相应的更改。
umount /mnt
```
3. 准备mmap置脏程序
```
#define _GNU_SOURCE

#include <stdio.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <assert.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/ioctl.h>

int main(int argc, char *argv[])
{
        int fd, ret;
        char *addr;
        size_t length = 0;
        off_t offset = 0;

fd = open(argv[1], O_RDWR);
        assert(fd >= 0);

offset = atoi(argv[2]) << 12;
        length = atoi(argv[3]) << 12;

printf("offset=%d, length=%d\n", offset, length);
        addr = mmap(NULL, length, PROT_READ | PROT_WRITE, MAP_SHARED, fd, offset);
        if (addr == MAP_FAILED) {
                close(fd);
                return -1;
        }

addr[0] = 'a';
        printf("write something\n");
        munmap(addr, length);
        close(fd);
        return 0;
}
```
4. 按以下步骤进行复现
```
mount -o data=journal /dev/pmem1 /mnt
./mmap /mnt/foo 0 1
sync &
sleep 1
xfs_io -c "truncate 0" /mnt/foo
```
执行后10s后出现use-after-free告警打印

## 问题根因
问题根因：
A                                  B
ext4_sync_file()
 file_write_and_wait_range()
                                   ext4_setattr()
                                    i_size_write(inode, 0)  <- 设置i_size为0
  ext4_writepage()
   len = 0  <- 回写长度为0
   __ext4_journalled_writepage()
    page_bufs = page_buffers(page); <- 取出了page_bufs但是没有持引用计数
                                    do_invalidatepage()
                                     __ext4_journalled_invalidatepage()
                                      free_buffer_head()  <- 释放buffer_head
    ext4_walk_page_buffers(page_bufs) <- 触发UAF

问题根因为在data=journal模式下，对于一个mmap write后的文件执行fsync和truncate操作并发，其中sync进程先持page锁，然后truncate进程如果现行将inode的size设置为0，这样__ext4_journalled_writepage()函数传入的len就等于0，这样它从page中获取buffer_head但是没有增加引用计数，这样在unlock_page()之后truncate进程就会将buffer_head和mapping释放，最后在尝试释放引用计数时访问buffer_haead->b_size时触发UAF。

GVP openEuler/kernel

内容风险标识

评论 (2)

GVPopenEuler/kernel

内容风险标识