In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
md\/raid5: avoid R5_Overlap races while breaking stripe batches<\/p>\n
KCSAN report a race in break_stripe_batch_list() vs. raid5_make_request()
\non sh->dev[i].flags (plain word write vs. atomic bit op)..<\/p>\n
and .. one possible scenario is:<\/p>\n
CPU1 CPU2
\nbreak_stripe_batch_list(sh1)
\n-> handle sh2
\n-> lock(sh2)
\n-> sh2->batch_head = NULL
\n-> unlock(sh2)
\n-> test_and_clear_bit(R5_Overlap, sh2->dev[i].flags)
\n-> wake_up_bit(sh2->dev[i].flags)
\n raid5_make_request()
\n -> add_all_stripe_bios(sh2)
\n -> lock(sh2)
\n -> stripe_bio_overlaps(sh2) returns true
\n\t\t\t\t batch_head is NULL, so new bio overlap
\n\t\t\t\t exist bio on sh2 -> true
\n -> set_bit(R5_Overlap, sh2->dev[i].flags)
\n -> unlock(sh2)
\n -> wait_on_bit(sh2->dev[i].flags)
\n-> sh2->dev[i].flags = sh1->dev[i].flags & ~R5_Overlap<\/p>\n
No wait_up_bit(), CPU2 could be wait_on_bit() forever…<\/p>\n
Fix by :
\n– Expand the protect zone.
\n– Use batch_head’s device flag’s snaphot when no held head_sh->stripe_lock.
\n– Move sh\/head_sh->batch_head = NULL to the end of protected zone , and ,
\n any concurrent add_all_stripe_bios() grabs sh->stripe_lock now either:
\n\t– see batch_head != null, and , is rejected by stripe_bio_overlaps()
\n\t under the lock (no R5_Overlap wait ) , or ,
\n\t– sees batch_head == NULL, only after dev[i].flags has already been
\n\t set and the prior R5_Overlap waiters worken.<\/p>\n
KCSAN report:
\n================================================
\n BUG: KCSAN: data-race in break_stripe_batch_list \/ raid5_make_request<\/p>\n
write (marked) to 0xffff8e89c8117548 of 8 bytes by task 4042 on cpu 0:
\n raid5_make_request+0xea0\/0x2930
\n md_handle_request+0x4a2\/0xa40
\n md_submit_bio+0x109\/0x1a0
\n __submit_bio+0x2ec\/0x390
\n submit_bio_noacct_nocheck+0x457\/0x710
\n submit_bio_noacct+0x2a7\/0xc20
\n submit_bio+0x56\/0x250
\n blkdev_direct_IO+0x54c\/0xda0
\n blkdev_write_iter+0x38f\/0x570
\n aio_write+0x22b\/0x490
\n io_submit_one+0xa51\/0xf70
\n __x64_sys_io_submit+0xf7\/0x220
\n x64_sys_call+0x1907\/0x1c60
\n do_syscall_64+0x130\/0x570
\n entry_SYSCALL_64_after_hwframe+0x76\/0x7e<\/p>\n
read to 0xffff8e89c8117548 of 8 bytes by task 4010 on cpu 5:
\n break_stripe_batch_list+0x249\/0x480
\n handle_stripe_clean_event+0x720\/0x9b0
\n handle_stripe+0x32fb\/0x4500
\n handle_active_stripes.isra.0+0x6e0\/0xa50
\n raid5d+0x7e0\/0xba0
\n md_thread+0x15a\/0x2d0
\n kthread+0x1e3\/0x220
\n ret_from_fork+0x37a\/0x410
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
value changed: 0x0000000000000019 -> 0x0000000000000099 –> R5_Overlap<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
md\/raid5: avoid R5_Overlap races while breaking stripe batches<\/p>\n
KCSAN report a race in break_stripe_batch_list() vs. raid5_make_req<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7075","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7075","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7075"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7075"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7075"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}