xfs: use-after-free in stats_clear sysctl handler during module unload

[徐晗翔 <xuhx@hust.edu.cn>]

[-- Attachment #1: Type: text/plain, Size: 8831 bytes --]

exit_xfs_fs() frees xfsstats.xs_stats before unregistering the fs/xfs
sysctl table.  A write to /proc/sys/fs/xfs/stats_clear that is already in
xfs_stats_clear_proc_handler(), or that enters between the free and the
unregister, calls xfs_stats_clearall() on the freed per-cpu pointer; that
function reads two counters from the area and then memsets the whole
per-cpu structure.  The result is a use-after-free read/write of a
per-cpu allocation, with the usual consequences when the area has been
reused: silent corruption of another subsystem's per-cpu data, random
crashes, or a KASAN report on a kernel whose per-cpu allocator is
instrumented.

The ordering bug is small but the synchronization argument is not
subtle.  unregister_sysctl_table() is the point that waits for an active
sysctl handler; it is called after free_percpu().  free_percpu() itself
does not wait for a handler and does not invalidate the existing sysctl
entry, so a writer can use the stale pointer before the wait starts.
The same free-then-unregister sequence exists on the init error path.
This is a teardown-order bug, not a missing lock in the handler.

The detailed description:

* Test environment / affected version

  Linux 7.3.0 snapshot (the tree used for this audit; Makefile reports
  VERSION=7 PATCHLEVEL=3 SUBLEVEL=0), x86_64, gcc 13.3.0, QEMU/KVM
  guest.  CONFIG_XFS_FS=m, CONFIG_PROC_FS=y, KASAN enabled.  The
  behavior is in the module load/unload path, so it is independent of
  the filesystem on disk; no XFS mount is required.

  The source lines below are from the 7.3.0 tree.  The order has been
  stable for a long time, but please re-check the exact line numbers on
  your tree before applying a patch.

* Mechanism

  The handler is registered for /proc/sys/fs/xfs/stats_clear at
  fs/xfs/xfs_sysctl.c:172-179 and executes:

      fs/xfs/xfs_sysctl.c:13-30
      xfs_stats_clear_proc_handler()
          ...
          ret = proc_dointvec_minmax(ctl, write, buffer, lenp, ppos);
          if (!ret && write && *valp) {
                  xfs_stats_clearall(xfsstats.xs_stats);
                  xfs_stats_clear = 0;
          }

  xfs_stats_clearall() walks every possible CPU, reads
  xs_inodes_active/xs_inodes_meta, and memsets the per-cpu structure:

      fs/xfs/xfs_stats.c:101-118
      for_each_possible_cpu(c) {
              preempt_disable();
              xs_inodes_active = per_cpu_ptr(stats, c)->s.xs_inodes_active;
              xs_inodes_meta = per_cpu_ptr(stats, c)->s.xs_inodes_meta;
              memset(per_cpu_ptr(stats, c), 0, sizeof(*stats));
              ...
              preempt_enable();
      }

  The unload path frees the pointer before the sysctl table is
  unregistered:

      fs/xfs/xfs_super.c:2748-2767
      exit_xfs_fs()
          ...
          xchk_global_stats_teardown();
          xfs_sysfs_del(&xfsstats.xs_kobj);
          free_percpu(xfsstats.xs_stats);        <-- pointer becomes stale
          kset_unregister(xfs_kset);
          debugfs_remove(xfs_debugfs);
          xfs_sysctl_unregister();               <-- wait happens too late

  unregister_sysctl_table() does wait for an active handler.  In
  fs/proc/proc_sysctl.c:300-307, start_unregistering() checks p->used;
  if a handler is active it arms a completion and waits.  The handler
  holds the sysctl header for the whole call
  (fs/proc/proc_sysctl.c:553-614), so the wait is effective once it is
  reached.  The bug is simply that free_percpu() is reached first.

  free_percpu() (mm/percpu.c:2240-2269) only returns the area to the
  per-cpu allocator.  It does not wait for sysctl users, does not
  synchronize_rcu(), and does not clear xfsstats.xs_stats.  After it
  returns, the area can be reused by the next alloc_percpu().

  An open fd on the sysctl file does not pin the module:
  proc_sys_open() (fs/proc/proc_sysctl.c:629-641) grabs the header only
  for the duration of open() and does not try_module_get().  So rmmod
  can proceed while a writer still has the file open.

  The init error path has the same order:

      fs/xfs/xfs_super.c:2727-2735
      out_remove_stats_kobj:
          xfs_sysfs_del(&xfsstats.xs_kobj);
      out_free_stats:
          free_percpu(xfsstats.xs_stats);
      out_kset_unregister:
          kset_unregister(xfs_kset);
      out_debugfs_unregister:
          debugfs_remove(xfs_debugfs);
          xfs_sysctl_unregister();

  If xfs_sysfs_init() fails, xs_stats is live and this is the same UAF.
  If alloc_percpu() failed earlier, xs_stats is NULL and
  xfs_stats_clearall(NULL) computes per_cpu_ptr(NULL, c) from the per-cpu
  base; the subsequent memset corrupts per-cpu data instead of doing a
  literal NULL dereference.  Both cases are fixed by unregistering the
  sysctl table before dropping the stats pointer.

  The race does not require the handler to start after free_percpu().
  A handler that entered xfs_stats_clearall() before the free and was
  preempted in the per-CPU loop will resume and write to the same area
  after free_percpu() returns.  unregister_sysctl_table() has not begun
  waiting at that point, so it cannot help.

* Trigger model

  - CONFIG_XFS_FS=m; XFS loaded as a module; CONFIG_PROC_FS=y.
  - No XFS filesystem is mounted (a mount holds a module reference and
    prevents rmmod).
  - A user able to write /proc/sys/fs/xfs/stats_clear (mode 0644,
    normally root) and to unload the module (root/CAP_SYS_MODULE).
  - SMP or preemptible kernel; a writer already inside the handler, or
    a writer entering between free_percpu() and
    xfs_sysctl_unregister(), races the unload.
  - Consequence: UAF read/write of the per-cpu area; if the area has
    been reused, corruption of another subsystem's per-cpu state,
    random crash, or memory-corruption symptoms.  This is a local
    privileged bug, not an unprivileged LPE.

* Reproducer 

  I used a KASAN-enabled 7.3.0 kernel with CONFIG_XFS_FS=m and a read-only kprobe detector
  (xfsrace.c).  The detector records the pointer passed to
  free_percpu() by the rmmod thread, confirms that
  xfs_sysctl_unregister() is entered after that free, and then compares
  the argument of every xfs_stats_clearall() call with the recorded
  pointer.  A match is reported as UAF-WINDOW.

  Controlled run: 16 writers loop on
  /proc/sys/fs/xfs/stats_clear, then rmmod xfs runs; the detector adds an
  800 ms stall at xfs_sysctl_unregister() to widen the window.  Result:

      XFSRACE: free_percpu(ffffffff9ff0f290) entry, comm=rmmod
      XFSRACE: xfs_sysctl_unregister() after free_percpu(ffffffff9ff0f290);
               stalling 800ms, comm=rmmod
      XFSRACE: UAF-WINDOW xfs_stats_clearall(ffffffff9ff0f290) after
               free_percpu, comm=init pid=124
      ...
      XFSRACE-INIT: rmmod status=0

  272 UAF-WINDOW lines, all with the same pointer ffffffff9ff0f290; the
  serial log is complete, the dmesg ring retained 132 of them.  Control
  runs: no writers -> 0; writers but no rmmod -> 0.

  KASAN did not produce a use-after-free report: free_percpu() uses the
  per-cpu allocator, and mm/percpu.c has no KASAN poison/unpoison hooks.
  The direct evidence is therefore the kprobe pointer comparison, not a
  KASAN stack.  I am stating this explicitly so the absence of a KASAN
  splat is not read as absence of the bug.

  The 800 ms stall is artificial.  It proves that the interleaving is
  reachable; it does not measure the natural hit rate.  The key lines
  and a stack excerpt are in the evidence/ directory of the report package;
  the full 512 KB serial log is available on request.

  Files attached:

      xfsrace.c             kprobe detector
      Makefile              detector build
      init-xfs              VM init: load xfs.ko, start writers, rmmod
      mkinitramfs-xfs.sh    build the test initramfs
      run-vm-xfs.sh         boot the XFS-enabled kernel under QEMU


* Suggested direction

  Move xfs_sysctl_unregister() before free_percpu(xfsstats.xs_stats) in
  exit_xfs_fs(), and apply the same ordering to the init error path.  The
  unregister then waits for active handlers, and the subsequent free
  cannot race with xfs_stats_clearall().

  As hardening, set xfsstats.xs_stats = NULL after free_percpu() and
  check it in xfs_stats_clear_proc_handler() (and in the sysfs
  stats_clear_store()); use READ_ONCE()/WRITE_ONCE() for the pointer if
  it is read outside the sysctl path.  The NULL check alone is not
  sufficient: a handler can still read the pointer while it is being
  freed, so the ordering fix is the root fix.

  I did not attach a patch because I do not know the introducing commit
  and because the fix should be reviewed together with the init error
  path.  I am happy to test a proposed patch on the same QEMU setup.


  Please keep me in Cc; I am not subscribed to the lists.

Regards,
Hanxiang Xu
xuhx@hust.edu.cn

[-- Attachment #2: poc.zip --]
[-- Type: application/x-zip-compressed, Size: 3752 bytes --]