Impact Analysis

The primary impact of this vulnerability is the risk of data loss. Because dirty cache blocks can be loaded into passthrough mode incorrectly, data that has not been properly written back to the underlying storage may be lost.

This can affect systems using dm-cache with writeback caching and table preloading, potentially causing corruption or loss of critical data during cache mode switching.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Linux kernel's device mapper cache (dm-cache) subsystem. It involves an incorrect assumption about how table reloads occur after suspension. Specifically, dm-cache assumed that table reload happens only after suspension, but Logical Volume Manager (LVM) uses table preload, which breaks this assumption.

The vulnerability is related to the dirty mapping check in passthrough mode, which was designed to run during table creation. Because of the preload behavior, this check can fail while metadata updates are ongoing, allowing dirty (unwritten) mappings to be loaded into passthrough mode.

This can lead to data loss because dirty cache blocks might be incorrectly handled during mode switching.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability relates to the dm-cache feature in the Linux kernel, specifically involving dirty mapping checks in passthrough mode during table preload and resume operations.

To detect the vulnerability or reproduce the conditions that expose it, you can perform the following steps using dmsetup and fio commands:

• Create a writeback cache with zero migration_threshold to produce dirty mappings using dmsetup create commands.
• Preload a table in passthrough mode with dmsetup reload.
• Write to the first cache block to make it dirty using fio.
• Resume the inactive table with dmsetup resume to check if dirty blocks are loaded into passthrough mode.

Example commands from the description are:

• dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"
• dmsetup create cdata --table "0 131072 linear /dev/sdc 8192"
• dmsetup create corig --table "0 262144 linear /dev/sdc 262144"
• dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
• dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writeback smq 2 migration_threshold 0"
• dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0"
• fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k --direct=1 --size=64k
• dmsetup resume cache

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by moving the dirty mapping checks to the preresume phase to support table preloading and by removing an unused function.

Immediate mitigation steps include:

• Update the Linux kernel to a version that includes the fix for this vulnerability.
• Avoid using dm-cache in passthrough mode with table preloading until the fix is applied.
• Monitor and control usage of writeback caches with zero migration_threshold to prevent dirty mappings from being loaded incorrectly.

Useful 0 Not Useful 0