CVE: CVE-2021-47379
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd

KASAN reports a use-after-free report when doing fuzz test:

[[PII_REDACTED]35] ==================================================================
[[PII_REDACTED]94] BUG: KASAN: use-after-free in bfq_io_set_weight_legacy+0xd3/0x160
[[PII_REDACTED]36] Read of size 4 at addr ffff888be0a35664 by task sh/1453338

[[PII_REDACTED]07] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147
[[PII_REDACTED]10] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018
[[PII_REDACTED]12] Call Trace:
[[PII_REDACTED]21]  dump_stack+0xf1/0x19b
[[PII_REDACTED]26]  ? show_regs_print_info+0x5/0x5
[[PII_REDACTED]34]  ? printk+0x9c/0xc3
[[PII_REDACTED]38]  ? cpumask_weight+0x1f/0x1f
[[PII_REDACTED]48]  print_address_description+0x70/0x360
[[PII_REDACTED]54]  kasan_report+0x1b2/0x330
[[PII_REDACTED]59]  ? bfq_io_set_weight_legacy+0xd3/0x160
[[PII_REDACTED]65]  ? bfq_io_set_weight_legacy+0xd3/0x160
[[PII_REDACTED]70]  bfq_io_set_weight_legacy+0xd3/0x160
[[PII_REDACTED]75]  ? bfq_cpd_init+0x20/0x20
[[PII_REDACTED]83]  cgroup_file_write+0x3aa/0x510
[[PII_REDACTED]93]  ? ___slab_alloc+0x507/0x540
[[PII_REDACTED]98]  ? cgroup_file_poll+0x60/0x60
[[PII_REDACTED]02]  ? 0xffffffff89600000
[[PII_REDACTED]08]  ? usercopy_abort+0x90/0x90
[[PII_REDACTED]16]  ? mutex_lock+0xef/0x180
[[PII_REDACTED]26]  kernfs_fop_write+0x1ab/0x280
[[PII_REDACTED]32]  ? cgroup_file_poll+0x60/0x60
[[PII_REDACTED]38]  vfs_write+0xe7/0x230
[[PII_REDACTED]44]  ksys_write+0xb0/0x140
[[PII_REDACTED]49]  ? __ia32_sys_read+0x50/0x50
[[PII_REDACTED]60]  do_syscall_64+0x112/0x370
[[PII_REDACTED]66]  ? syscall_return_slowpath+0x260/0x260
[[PII_REDACTED]72]  ? do_page_fault+0x9b/0x270
[[PII_REDACTED]79]  ? prepare_exit_to_usermode+0xf9/0x1a0
[[PII_REDACTED]84]  ? enter_from_user_mode+0x30/0x30
[[PII_REDACTED]93]  entry_SYSCALL_64_after_hwframe+0x65/0xca

[[PII_REDACTED]75] Allocated by task 1453337:
[[PII_REDACTED]01]  kasan_kmalloc+0xa0/0xd0
[[PII_REDACTED]06]  kmem_cache_alloc_node_trace+0x108/0x220
[[PII_REDACTED]10]  bfq_pd_alloc+0x96/0x120
[[PII_REDACTED]15]  blkcg_activate_policy+0x1b7/0x2b0
[[PII_REDACTED]20]  bfq_create_group_hierarchy+0x1e/0x80
[[PII_REDACTED]26]  bfq_init_queue+0x678/0x8c0
[[PII_REDACTED]31]  blk_mq_init_sched+0x1f8/0x460
[[PII_REDACTED]37]  elevator_switch_mq+0xe1/0x240
[[PII_REDACTED]41]  elevator_switch+0x25/0x40
[[PII_REDACTED]45]  elv_iosched_store+0x1a1/0x230
[[PII_REDACTED]49]  queue_attr_store+0x78/0xb0
[[PII_REDACTED]53]  kernfs_fop_write+0x1ab/0x280
[[PII_REDACTED]56]  vfs_write+0xe7/0x230
[[PII_REDACTED]60]  ksys_write+0xb0/0x140
[[PII_REDACTED]64]  do_syscall_64+0x112/0x370
[[PII_REDACTED]69]  entry_SYSCALL_64_after_hwframe+0x65/0xca

[[PII_REDACTED]14] Freed by task 1453336:
[[PII_REDACTED]25]  __kasan_slab_free+0x130/0x180
[[PII_REDACTED]29]  kfree+0x90/0x1b0
[[PII_REDACTED]33]  blkcg_deactivate_policy+0x12c/0x220
[[PII_REDACTED]38]  bfq_exit_queue+0xf5/0x110
[[PII_REDACTED]41]  blk_mq_exit_sched+0x104/0x130
[[PII_REDACTED]45]  __elevator_exit+0x45/0x60
[[PII_REDACTED]49]  elevator_switch_mq+0xd6/0x240
[[PII_REDACTED]53]  elevator_switch+0x25/0x40
[[PII_REDACTED]57]  elv_iosched_store+0x1a1/0x230
[[PII_REDACTED]61]  queue_attr_store+0x78/0xb0
[[PII_REDACTED]64]  kernfs_fop_write+0x1ab/0x280
[[PII_REDACTED]68]  vfs_write+0xe7/0x230
[[PII_REDACTED]71]  ksys_write+0xb0/0x140
[[PII_REDACTED]75]  do_syscall_64+0x112/0x370
[[PII_REDACTED]80]  entry_SYSCALL_64_after_hwframe+0x65/0xca

[[PII_REDACTED]29] The buggy address belongs to the object at ffff888be0a35580
                 which belongs to the cache kmalloc-1k of size 1024
[[PII_REDACTED]36] The buggy address is located 228 bytes inside of
                 1024-byte region [ffff888be0a35580, ffff888be0a35980)
[[PII_REDACTED]14] The buggy address belongs to the page:
[[PII_REDACTED]73] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0 compound_mapcount: 0
[[PII_REDACTED]06] flags: 0x17ffffc0008100(slab|head)
[[PII_REDACTED]60] raw: 0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080
[[PII_REDACTED]20] r
---truncated---
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/7c2c69e010431b0157c9454adcdd2305809bf9fb; https://git.kernel.org/stable/c/858560b27645e7e97aca37ee8f232cccd658fbd2; https://git.kernel.org/stable/c/d12ddd843f1877de1f7dd2aeea4907cf9ff3ac08