[BUG] dm-stats: null-ptr-deref in dm_stat_free on stats alloc failure

[Junzhe Yu <junzheyu1@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2989 bytes --]

Hello,

I am reporting a null-pointer dereference in device-mapper dm-stats when
@stats_create fails part-way through per-CPU buffer allocation.

Summary
=======

dm_stats_create() allocates per-CPU stat buffers in a loop. On mid-loop
ENOMEM it jumps to out: and calls dm_stat_free(). dm_stat_free() then
dereferences s->stat_percpu[cpu] without a NULL check, including for CPUs
that never received a successful allocation (still NULL from zero-init).

The crash is a KASAN null-ptr-deref / general protection fault in
dm_stat_free() at drivers/md/dm-stats.c, reached via DM_TARGET_MSG
@stats_create.

Affected
========

- Confirmed on Linux 6.6.145 (KASAN + CONFIG_FAIL_PAGE_ALLOC); also
   reproduced earlier on 6.6.144
- Originally found on Linux 6.6.0 via syzkaller
- Files: drivers/md/dm-stats.c
- Config: CONFIG_DM=y; CONFIG_FAIL_PAGE_ALLOC=y makes the PoC deterministic

Root cause (brief)
==================

1. dm_stats_create() does for_each_possible_cpu(): dm_kvzalloc(...);
    on failure: r = -ENOMEM; goto out;
2. out: calls dm_stat_free(&s->rcu_head)
3. dm_stat_free() does for_each_possible_cpu():
      dm_kvfree(s->stat_percpu[cpu][0].histogram, ...);
    with no NULL guard — NPD when that CPU never allocated.

Needs enough CPUs that fail_page_alloc can fail after some CPUs succeed
(guest with >= 4 vCPUs). Partial init on the error path is not cleaned up
safely.

Crash excerpt (6.6.145 KASAN)
=============================

general protection fault ... KASAN: null-ptr-deref in range [0x60-0x67]
CPU: ... Comm: repro Not tainted 6.6.145 #1
RIP: 0010:dm_stat_free+0x12c/0x360
Call Trace:
   dm_stats_message
   target_message
   ctl_ioctl
   dm_ctl_ioctl
Kernel panic - not syncing: Fatal exception

Full excerpt is in crash_excerpt.txt in the attachment.

Impact
======

Privileged local DoS (CAP_SYS_ADMIN required for /dev/mapper/control).
NULL deref, not UAF — practical impact is denial of service under memory
pressure / fault injection on the @stats_create path.

Reproducer
==========

Attached: dm-stat-free-null-deref-repro.tar.gz

VM-only (do not run on a production host). Minimized C PoC: create a
zero-target DM device, resume, send @stats_create - 1024 while
fail_page_alloc is armed (fallback: memory hog). Guest needs >= 4 vCPUs.

Quick path (Docker + KVM):

   tar xzf dm-stat-free-null-deref-repro.tar.gz
   cd <extracted-dir>
   docker build -t dm-stat-free-null-deref -f Dockerfile .
   mkdir -p artifacts
   docker run --rm --privileged --device=/dev/kvm --network=host \
     -v "$PWD/artifacts:/artifacts" \
     -e OUTPUT_DIR=/artifacts \
     -e VM_MEMORY_MB=512 \
     -e VM_CPUS=4 \
     dm-stat-free-null-deref

Expected shortly after the PoC runs (first run also builds the kernel):

   KASAN: null-ptr-deref ... dm_stat_free
   Kernel panic - not syncing: Fatal exception

I am happy to test patches. Please let me know if you need more detail.

Thanks,
Yu Junzhe
FuzzAnything <fuzzanything@gmail.com>


[-- Attachment #2: dm-stat-free-null-deref-repro.tar.gz --]
[-- Type: application/x-gzip, Size: 11582 bytes --]