Ubuntu
linux package

unprivileged users may trigger page cache invalidation WARN

Bug #1989144 reported by Thadeu Lima de Souza Cascardo
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Invalid
Undecided
Unassigned
Bionic
Fix Released
Medium
Thadeu Lima de Souza Cascardo

Bug Description

[Impact]
Unprivileged users may trigger a page cache invalidation failure when doing parallel direct I/O and buffered I/O. On some kernels, that may lead to a WARN.

[ 22.415082] WARNING: CPU: 3 PID: 3404 at /build/linux-GtMq7R/linux-4.15.0/fs/iomap.c:903 iomap_dio_actor+0xbd/0x460
[ 22.415083] Modules linked in: xfs isofs kvm_intel kvm irqbypass joydev input_leds serio_raw ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd glue_helper cryptd psmouse ahci libahci virtio_blk virtio_net
[ 22.415099] CPU: 3 PID: 3404 Comm: xfs_io Not tainted 4.15.0-192-generic #203-Ubuntu
[ 22.415100] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
[ 22.415103] RIP: 0010:iomap_dio_actor+0xbd/0x460
[ 22.415104] RSP: 0018:ffffb7c782fe7bf0 EFLAGS: 00010202
[ 22.415104] RAX: 0000000000000002 RBX: 0000000000000000 RCX: 0000000000000009
[ 22.415105] RDX: 00000000000001ff RSI: 0000000000000000 RDI: ffffb7c782fe7e20
[ 22.415105] RBP: ffffb7c782fe7c68 R08: ffffb7c782fe7c88 R09: ffff9bbc9f48fba0
[ 22.415106] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000009
[ 22.415106] R13: ffff9bbc9f48fba0 R14: ffffb7c782fe7c88 R15: 0000000000001000
[ 22.415107] FS: 00007f2b802ed700(0000) GS:ffff9bbcbfd80000(0000) knlGS:0000000000000000
[ 22.415107] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 22.415108] CR2: 0000000001639000 CR3: 000000001e6b0003 CR4: 0000000000760ee0
[ 22.415110] PKRU: 55555554
[ 22.415110] Call Trace:
[ 22.415122] ? iomap_dio_zero+0x130/0x130
[ 22.415123] iomap_apply+0xa5/0x120
[ 22.415124] ? iomap_dio_zero+0x130/0x130
[ 22.415125] iomap_dio_rw+0x2f3/0x430
[ 22.415126] ? iomap_dio_zero+0x130/0x130
[ 22.415148] xfs_file_dio_aio_read+0x68/0xf0 [xfs]
[ 22.415157] ? xfs_file_dio_aio_read+0x68/0xf0 [xfs]
[ 22.415165] xfs_file_read_iter+0xbf/0xe0 [xfs]
[ 22.415170] new_sync_read+0xe4/0x130
[ 22.415171] __vfs_read+0x29/0x40
[ 22.415172] vfs_read+0x8e/0x130
[ 22.415173] SyS_pread64+0x95/0xb0
[ 22.415176] do_syscall_64+0x73/0x130
[ 22.415183] entry_SYSCALL_64_after_hwframe+0x41/0xa6
[ 22.415184] RIP: 0033:0x7f2b7fbc0b73
[ 22.415185] RSP: 002b:00007ffc134e1a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000011
[ 22.415186] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2b7fbc0b73
[ 22.415186] RDX: 0000000000001000 RSI: 0000000001639000 RDI: 0000000000000003
[ 22.415186] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 22.415187] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc134e1b00
[ 22.415187] R13: 0000000000020000 R14: 0000000000000000 R15: 0000000000000000
[ 22.415188] Code: 21 d0 48 89 45 a0 0f 85 aa 03 00 00 41 0f b7 46 18 66 83 f8 03 0f 84 7e 02 00 00 66 83 f8 04 74 52 66 83 f8 01 0f 84 c8 02 00 00 <0f> 0b 48 c7 45 a0 fb ff ff ff 48 8b 5d d0 65 48 33 1c 25 28 00

[Test case]
Run xfstests generic/446 test.

[Potential regressions]
Data corruption could be caused, though it is expected to be caused in such scenarions anyway. That should affecte direct I/O.

CVE References

Thadeu Lima de Souza Cascardo (cascardo)
Changed in linux (Ubuntu Bionic):
assignee: nobody → Thadeu Lima de Souza Cascardo (cascardo)
importance: Undecided → Medium
status: New → In Progress
Changed in linux (Ubuntu):
status: New → Invalid
Luke Nowakowski-Krijger (lukenow)
Changed in linux (Ubuntu Bionic):
status: In Progress → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux/4.15.0-195.206 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux/4.15.0-196.207 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux/4.15.0-197.208 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (19.8 KiB)

This bug was fixed in the package linux - 4.15.0-197.208

---------------
linux (4.15.0-197.208) bionic; urgency=medium

  * bionic/linux: 4.15.0-197.208 -proposed tracker (LP: #1994998)

  * Memory leak while using NFQUEUE to delegate the decision on TCP packets to
    userspace processes (LP: #1991774)
    - SAUCE: netfilter: nf_queue: Fix memory leak in nf_queue_entry_get_refs

  * Bionic update: upstream stable patchset 2022-09-23 (LP: #1990698)
    - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
    - ntfs: fix use-after-free in ntfs_ucsncmp()
    - ARM: crypto: comment out gcc warning that breaks clang builds
    - mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
    - ACPI: video: Force backlight native for some TongFang devices
    - macintosh/adb: fix oob read in do_adb_query() function
    - Makefile: link with -z noexecstack --no-warn-rwx-segments
    - x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments
    - ALSA: bcd2000: Fix a UAF bug on the error path of probing
    - add barriers to buffer_uptodate and set_buffer_uptodate
    - HID: wacom: Don't register pad_input for touch switch
    - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
    - KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
    - KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP
    - ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
    - ALSA: hda/cirrus - support for iMac 12,1 model
    - vfs: Check the truncate maximum size in inode_newsize_ok()
    - fs: Add missing umask strip in vfs_tmpfile
    - usbnet: Fix linkwatch use-after-free on disconnect
    - parisc: Fix device names in /proc/iomem
    - drm/nouveau: fix another off-by-one in nvbios_addr
    - drm/amdgpu: Check BO's requested pinning domains against its
      preferred_domains
    - iio: light: isl29028: Fix the warning in isl29028_remove()
    - fuse: limit nsec
    - md-raid10: fix KASAN warning
    - ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
    - PCI: Add defines for normal and subtractive PCI bridges
    - powerpc/fsl-pci: Fix Class Code of PCIe Root Port
    - powerpc/powernv: Avoid crashing if rng is NULL
    - MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
    - USB: HCD: Fix URB giveback issue in tasklet function
    - netfilter: nf_tables: fix null deref due to zeroed list head
    - arm64: Do not forget syscall when starting a new thread.
    - arm64: fix oops in concurrently setting insn_emulation sysctls
    - ext2: Add more validity checks for inode counts
    - ARM: dts: imx6ul: add missing properties for sram
    - ARM: dts: imx6ul: fix qspi node compatible
    - ARM: OMAP2+: display: Fix refcount leak bug
    - ACPI: PM: save NVS memory for Lenovo G40-45
    - ACPI: LPSS: Fix missing check in register_device_clock()
    - PM: hibernate: defer device probing when resuming from hibernation
    - selinux: Add boundary check in put_entry()
    - ARM: findbit: fix overflowing offset
    - ARM: bcm: Fix refcount leak in bcm_kona_smc_init
    - x86/pmem: Fix platform-device leak in error path
    - ARM: dts: ast2500-evb: fix bo...

Changed in linux (Ubuntu Bionic):
status: Fix Committed → Fix Released
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-azure-4.15/4.15.0-1157.172 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-bionic-linux-azure-4.15 verification-needed-bionic
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.