漏洞标题
没有内容
漏洞描述信息
在Linux内核中，以下漏洞已得到解决：
bcachefs：只有在快照时才获取s_umount锁
当我在启用压缩的bcachefs上测试mongodb时，快照mongodb数据卷时会出现lockdep警告。
$ cat test.sh
prog=bcachefs
$prog subvolume create /mnt/data
$prog subvolume create /mnt/data2
# 启动mongodb实例
mongod --dbpath=/mnt/data
# 使用另一个会话运行以下命令以创建快照
$prog snapshot -s snap1 /mnt/data
# 在原始会话中写入数据以触发fsync
echo "test" >> /mnt/data/test.txt
# 再次创建快照，观察警告
$prog snapshot -s snap2 /mnt/data
输出：
[master 6078539] On node: d41d8cd98f00b204e9800998ecf8427e
锁持有者：bcachefs/35533 任务：0x7fffb2769cc0 CPU：0
锁定等待者：bcachefs/35533 任务：0x7fffb2769cc0 CPU：1
[ 3437.460805] Lock name: sb_writers#10
[ 3437.460850] acquiring lock at:
/build/linux-lts/stretch.git+v5.12.14/fs/subvolume.c:369 in function filename_create
[ 3437.460876] held locks at acquiring time:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
[ 3437.460910] held locks after acquiring lock:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
sb_writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
[ 3437.460936] acquiring lock at:
/build/linux-lts/stretch.git+v5.12.14/fs/subvolume.c:204 in function bch2_ckpt_flush
[ 3437.460959] held locks at acquiring time:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
sb_writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
[ 3437.460984] held locks after acquiring lock:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
sb_writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
[ 3437.461010] acquiring lock at:
/build/linux-lts/stretch.git+v5.12.14/fs/subvolume.c:334 in function bch2_ckpt_write
[ 3437.461028] held locks at acquiring time:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
sb_writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
[ 3437.461053] held locks after acquiring lock:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
sb_writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
[ 3437.461078] acquiring lock at:
/build/linux-lts/stretch.git+v5.12.14/fs/subvolume.c:213 in function bch2_ckpt_flush
[ 3437.461099] held locks at acquiring time:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
sb_writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
[ 3437.461124] held locks after acquiring lock:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
sb_writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
[ 3437.461149] acquiring lock at:
/build/linux-lts/stretch.git+v5.12.14/fs/subvolume.c:334 in function bch2_ckpt_write
[ 3437.461168] held locks at acquiring time:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
sb_writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
[ 3437.461193] held locks after acquiring lock:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
sb_writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
[ 3437.461218] acquiring lock at:
/build/linux-lts/stretch.git+v5.12.14/fs/subvolume.c:213 in function bch2_ckpt_flush
[ 3437.461239] held locks at acquiring time:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
sb_writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
[ 3437.461264] held locks after acquiring lock:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
sb_writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
[ 3437.461289] acquiring lock at:
/build/linux-lts/stretch.git+v5.12.14/fs/subvolume.c:334 in function bch2_ckpt_write
[ 3437.461308] held locks at acquiring time:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
sb_writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
[ 3437.461333] held locks after acquiring lock:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
c->snapshot_create_lock on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
s_otype->i_mutex_key#15 on 8f516227-b5ad-4c0b-8f4f-d5588fa3694c
sb_writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
[ 3437.461358] acquiring lock at:
/build/linux-lts/stretch.git+v5.12.14/fs/subvolume.c:213 in function bch2_ckpt_flush
[ 3437.461379] held locks at acquiring time:
writers#10 on b314f34c-93a2-49f4-a3e0-c40b9e25d089
CVSS信息
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞类别
加锁机制不恰当
漏洞标题
bcachefs: grab s_umount only if snapshotting
漏洞描述信息
In the Linux kernel, the following vulnerability has been resolved:
bcachefs: grab s_umount only if snapshotting
When I was testing mongodb over bcachefs with compression,
there is a lockdep warning when snapshotting mongodb data volume.
$ cat test.sh
prog=bcachefs
$prog subvolume create /mnt/data
$prog subvolume create /mnt/data/snapshots
while true;do
$prog subvolume snapshot /mnt/data /mnt/data/snapshots/$(date +%s)
sleep 1s
done
$ cat /etc/mongodb.conf
systemLog:
destination: file
logAppend: true
path: /mnt/data/mongod.log
storage:
dbPath: /mnt/data/
lockdep reports:
[ 3437.452330] ======================================================
[ 3437.452750] WARNING: possible circular locking dependency detected
[ 3437.453168] 6.7.0-rc7-custom+ #85 Tainted: G E
[ 3437.453562] ------------------------------------------------------
[ 3437.453981] bcachefs/35533 is trying to acquire lock:
[ 3437.454325] ffffa0a02b2b1418 (sb_writers#10){.+.+}-{0:0}, at: filename_create+0x62/0x190
[ 3437.454875]
but task is already holding lock:
[ 3437.455268] ffffa0a02b2b10e0 (&type->s_umount_key#48){.+.+}-{3:3}, at: bch2_fs_file_ioctl+0x232/0xc90 [bcachefs]
[ 3437.456009]
which lock already depends on the new lock.
[ 3437.456553]
the existing dependency chain (in reverse order) is:
[ 3437.457054]
-> #3 (&type->s_umount_key#48){.+.+}-{3:3}:
[ 3437.457507] down_read+0x3e/0x170
[ 3437.457772] bch2_fs_file_ioctl+0x232/0xc90 [bcachefs]
[ 3437.458206] __x64_sys_ioctl+0x93/0xd0
[ 3437.458498] do_syscall_64+0x42/0xf0
[ 3437.458779] entry_SYSCALL_64_after_hwframe+0x6e/0x76
[ 3437.459155]
-> #2 (&c->snapshot_create_lock){++++}-{3:3}:
[ 3437.459615] down_read+0x3e/0x170
[ 3437.459878] bch2_truncate+0x82/0x110 [bcachefs]
[ 3437.460276] bchfs_truncate+0x254/0x3c0 [bcachefs]
[ 3437.460686] notify_change+0x1f1/0x4a0
[ 3437.461283] do_truncate+0x7f/0xd0
[ 3437.461555] path_openat+0xa57/0xce0
[ 3437.461836] do_filp_open+0xb4/0x160
[ 3437.462116] do_sys_openat2+0x91/0xc0
[ 3437.462402] __x64_sys_openat+0x53/0xa0
[ 3437.462701] do_syscall_64+0x42/0xf0
[ 3437.462982] entry_SYSCALL_64_after_hwframe+0x6e/0x76
[ 3437.463359]
-> #1 (&sb->s_type->i_mutex_key#15){+.+.}-{3:3}:
[ 3437.463843] down_write+0x3b/0xc0
[ 3437.464223] bch2_write_iter+0x5b/0xcc0 [bcachefs]
[ 3437.464493] vfs_write+0x21b/0x4c0
[ 3437.464653] ksys_write+0x69/0xf0
[ 3437.464839] do_syscall_64+0x42/0xf0
[ 3437.465009] entry_SYSCALL_64_after_hwframe+0x6e/0x76
[ 3437.465231]
-> #0 (sb_writers#10){.+.+}-{0:0}:
[ 3437.465471] __lock_acquire+0x1455/0x21b0
[ 3437.465656] lock_acquire+0xc6/0x2b0
[ 3437.465822] mnt_want_write+0x46/0x1a0
[ 3437.465996] filename_create+0x62/0x190
[ 3437.466175] user_path_create+0x2d/0x50
[ 3437.466352] bch2_fs_file_ioctl+0x2ec/0xc90 [bcachefs]
[ 3437.466617] __x64_sys_ioctl+0x93/0xd0
[ 3437.466791] do_syscall_64+0x42/0xf0
[ 3437.466957] entry_SYSCALL_64_after_hwframe+0x6e/0x76
[ 3437.467180]
other info that might help us debug this:
[ 3437.469670] 2 locks held by bcachefs/35533:
other info that might help us debug this:
[ 3437.467507] Chain exists of:
sb_writers#10 --> &c->snapshot_create_lock --> &type->s_umount_key#48
[ 3437.467979] Possible unsafe locking scenario:
[ 3437.468223] CPU0 CPU1
[ 3437.468405] ---- ----
[ 3437.468585] rlock(&type->s_umount_key#48);
[ 3437.468758] lock(&c->snapshot_create_lock);
[ 3437.469030] lock(&type->s_umount_key#48);
[ 3437.469291] rlock(sb_writers#10);
[ 3437.469434]
*** DEADLOCK ***
[ 3437.469
---truncated---
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Linux kernel 安全漏洞
漏洞描述信息
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于grab s_umount存在安全漏洞。
CVSS信息
N/A
漏洞类别
其他