Hello, I am reporting a null-pointer dereference in device-mapper dm-stats when @stats_create fails part-way through per-CPU buffer allocation.
Summary ======= dm_stats_create() allocates per-CPU stat buffers in a loop. On mid-loop ENOMEM it jumps to out: and calls dm_stat_free(). dm_stat_free() then dereferences s->stat_percpu[cpu] without a NULL check, including for CPUs that never received a successful allocation (still NULL from zero-init). The crash is a KASAN null-ptr-deref / general protection fault in dm_stat_free() at drivers/md/dm-stats.c, reached via DM_TARGET_MSG @stats_create. Affected ======== - Confirmed on Linux 6.6.145 (KASAN + CONFIG_FAIL_PAGE_ALLOC); also reproduced earlier on 6.6.144 - Originally found on Linux 6.6.0 via syzkaller - Files: drivers/md/dm-stats.c - Config: CONFIG_DM=y; CONFIG_FAIL_PAGE_ALLOC=y makes the PoC deterministic Root cause (brief) ================== 1. dm_stats_create() does for_each_possible_cpu(): dm_kvzalloc(...); on failure: r = -ENOMEM; goto out; 2. out: calls dm_stat_free(&s->rcu_head) 3. dm_stat_free() does for_each_possible_cpu(): dm_kvfree(s->stat_percpu[cpu][0].histogram, ...); with no NULL guard — NPD when that CPU never allocated. Needs enough CPUs that fail_page_alloc can fail after some CPUs succeed (guest with >= 4 vCPUs). Partial init on the error path is not cleaned up safely. Crash excerpt (6.6.145 KASAN) ============================= general protection fault ... KASAN: null-ptr-deref in range [0x60-0x67] CPU: ... Comm: repro Not tainted 6.6.145 #1 RIP: 0010:dm_stat_free+0x12c/0x360 Call Trace: dm_stats_message target_message ctl_ioctl dm_ctl_ioctl Kernel panic - not syncing: Fatal exception Full excerpt is in crash_excerpt.txt in the attachment. Impact ====== Privileged local DoS (CAP_SYS_ADMIN required for /dev/mapper/control). NULL deref, not UAF — practical impact is denial of service under memory pressure / fault injection on the @stats_create path. Reproducer ========== Attached: dm-stat-free-null-deref-repro.tar.gz VM-only (do not run on a production host). Minimized C PoC: create a zero-target DM device, resume, send @stats_create - 1024 while fail_page_alloc is armed (fallback: memory hog). Guest needs >= 4 vCPUs. Quick path (Docker + KVM): tar xzf dm-stat-free-null-deref-repro.tar.gz cd <extracted-dir> docker build -t dm-stat-free-null-deref -f Dockerfile . mkdir -p artifacts docker run --rm --privileged --device=/dev/kvm --network=host \ -v "$PWD/artifacts:/artifacts" \ -e OUTPUT_DIR=/artifacts \ -e VM_MEMORY_MB=512 \ -e VM_CPUS=4 \ dm-stat-free-null-deref Expected shortly after the PoC runs (first run also builds the kernel): KASAN: null-ptr-deref ... dm_stat_free Kernel panic - not syncing: Fatal exception I am happy to test patches. Please let me know if you need more detail. Thanks, Yu Junzhe FuzzAnything <[email protected]>
dm-stat-free-null-deref-repro.tar.gz
Description: GNU Zip compressed data
