Executive Summary

This vulnerability exists in the Linux kernel's dm cache policy smq, specifically related to missing locks when invalidating cache blocks in passthrough mode.

In passthrough mode, the invalidate_mapping operation can be called simultaneously from multiple workers without proper locking, which can cause data races on the allocated blocks counter or use-after-free issues with internal data structures during concurrent writes.

The problem arises because multiple workers may invalidate cache blocks at the same time, leading to unsafe concurrent access to shared data structures.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to data corruption or system instability due to data races and use-after-free conditions when multiple workers invalidate cache blocks concurrently.

Such issues could cause unexpected behavior in the caching mechanism, potentially resulting in loss of data integrity or crashes in systems relying on the dm cache policy smq in passthrough mode.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by reproducing the conditions that trigger the data races and use-after-free issues in the dm cache policy smq in passthrough mode. The following steps and commands can be used to detect it:

• Create a cache device with 1024 cache entries using dmsetup commands:
• dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"
• dmsetup create cdata --table "0 131072 linear /dev/sdc 8192"
• dmsetup create corig --table "0 262144 linear /dev/sdc 262144"
• dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
• dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
• Populate the cache and record the number of cached blocks using fio and dmsetup status:
• fio --name=populate --filename=/dev/mapper/cache --rw=randwrite --bs=4k --size=64m --direct=1
• nr_cached=$(dmsetup status cache | awk '{split($7, a, "/"); print a[1]}')
• Reload the cache into passthrough mode:
• dmsetup suspend cache
• dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0"
• dmsetup resume cache
• Write to the passthrough cache with multiple jobs to cause concurrent invalidation:
• fio --filename=/dev/mapper/cache --name=test --rw=randwrite --bs=64k --direct=1 --numjobs=2 --randrepeat=0 --size=64m
• Check if the number of demoted blocks matches the cached blocks (they may differ if the vulnerability is present):
• nr_demoted=$(dmsetup status cache | awk '{print $12}')
• echo "$nr_cached, $nr_demoted"

Useful 0 Not Useful 0

Mitigation Strategies

The provided information does not specify explicit immediate mitigation steps. However, since the vulnerability involves missing locks in the dm cache policy smq in passthrough mode, a general mitigation approach would be to avoid using passthrough mode for the cache policy until a patch or fix is applied.

Additionally, applying the updated Linux kernel version that includes the fix for this vulnerability is recommended to prevent data races and use-after-free issues.

Useful 0 Not Useful 0