dm crypt: do not call bio_endio() from the dm-crypt tasklet
stable inclusion from stable-5.10.9 commit fe40f6a6309fd4bbfd8290cc1ff517aaf1ac5abe bugzilla: 47457 -------------------------------- commit 8e14f610 upstream. Sometimes, when dm-crypt executes decryption in a tasklet, we may get "BUG: KASAN: use-after-free in tasklet_action_common.constprop..." with a kasan-enabled kernel. When the decryption fully completes in the tasklet, dm-crypt will call bio_endio(), which in turn will call clone_endio() from dm.c core code. That function frees the resources associated with the bio, including per bio private structures. For dm-crypt it will free the current struct dm_crypt_io, which contains our tasklet object, causing use-after-free, when the tasklet is being dequeued by the kernel. To avoid this, do not call bio_endio() from the current tasklet context, but delay its execution to the dm-crypt IO workqueue. Fixes: 39d42fa9 ("dm crypt: add flags to optionally bypass kcryptd workqueues") Cc: <stable@vger.kernel.org> # v5.9+ Signed-off-by:Ignat Korchagin <ignat@cloudflare.com> Signed-off-by:
Mike Snitzer <snitzer@redhat.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
Chen Jun <chenjun102@huawei.com> Acked-by:
Xie XiuQi <xiexiuqi@huawei.com>
Loading
Please sign in to comment