Executive Summary

This vulnerability exists in the Linux kernel's device mapper cache (dm-cache) when operating in passthrough mode. It occurs due to a null pointer dereference caused by concurrent writes to the same cached block. Specifically, when dm-cache tries to invalidate a cache entry, if the bio prison cell lock fails because of concurrent writes, an internal pointer (mg->cell) remains NULL. The error handling code then attempts to unlock and free this NULL pointer, leading to a kernel crash.

The issue can be reproduced by creating a cache device, promoting a data block into the cache, switching the cache to passthrough mode, and then performing concurrent writes to the cached block. The fix involves checking if the pointer mg->cell is valid before attempting to unlock it, preventing the null pointer dereference.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a kernel crash due to a null pointer dereference when concurrent writes occur on the same cached block in passthrough mode. Such crashes can lead to system instability, potential data loss, or denial of service as the affected system may become unresponsive or reboot unexpectedly.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by reproducing the conditions that trigger the null pointer dereference in the Linux kernel's dm-cache passthrough mode.

The following commands can be used to reproduce and detect the issue:

• Create cache devices using dmsetup:
• dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"
• dmsetup create cdata --table "0 131072 linear /dev/sdc 8192"
• dmsetup create corig --table "0 262144 linear /dev/sdc 262144"
• Initialize cache metadata with dd:
• dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
• Create the cache device:
• dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
• Promote the first data block into cache using fio:
• fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k --direct=1 --size=64k
• Reload the cache into passthrough mode:
• dmsetup suspend cache
• dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0"
• dmsetup resume cache
• Write concurrently to the first cached block to trigger the issue:
• fio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k --randrepeat=0 --direct=1 --numjobs=2 --size 64k

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to apply the fix that checks if the mg->cell pointer is valid before attempting to unlock it, preventing the null pointer dereference.

Practically, this means updating the Linux kernel to a version that includes this fix.

Until the fix is applied, avoid using dm-cache in passthrough mode with concurrent writes to the same cached block, as this triggers the vulnerability.

Useful 0 Not Useful 0