[BUG] dm-stats: null-ptr-deref in dm_stat_free on stats alloc failure

[BUG] dm-stats: null-ptr-deref in dm_stat_free on stats alloc failure

[Junzhe Yu]

[-- Attachment #1: Type: text/plain, Size: 2989 bytes --]

Hello,

I am reporting a null-pointer dereference in device-mapper dm-stats when
@stats_create fails part-way through per-CPU buffer allocation.

Summary
=======

dm_stats_create() allocates per-CPU stat buffers in a loop. On mid-loop
ENOMEM it jumps to out: and calls dm_stat_free(). dm_stat_free() then
dereferences s->stat_percpu[cpu] without a NULL check, including for CPUs
that never received a successful allocation (still NULL from zero-init).

The crash is a KASAN null-ptr-deref / general protection fault in
dm_stat_free() at drivers/md/dm-stats.c, reached via DM_TARGET_MSG
@stats_create.

Affected
========

- Confirmed on Linux 6.6.145 (KASAN + CONFIG_FAIL_PAGE_ALLOC); also
   reproduced earlier on 6.6.144
- Originally found on Linux 6.6.0 via syzkaller
- Files: drivers/md/dm-stats.c
- Config: CONFIG_DM=y; CONFIG_FAIL_PAGE_ALLOC=y makes the PoC deterministic

Root cause (brief)
==================

1. dm_stats_create() does for_each_possible_cpu(): dm_kvzalloc(...);
    on failure: r = -ENOMEM; goto out;
2. out: calls dm_stat_free(&s->rcu_head)
3. dm_stat_free() does for_each_possible_cpu():
      dm_kvfree(s->stat_percpu[cpu][0].histogram, ...);
    with no NULL guard — NPD when that CPU never allocated.

Needs enough CPUs that fail_page_alloc can fail after some CPUs succeed
(guest with >= 4 vCPUs). Partial init on the error path is not cleaned up
safely.

Crash excerpt (6.6.145 KASAN)
=============================

general protection fault ... KASAN: null-ptr-deref in range [0x60-0x67]
CPU: ... Comm: repro Not tainted 6.6.145 #1
RIP: 0010:dm_stat_free+0x12c/0x360
Call Trace:
   dm_stats_message
   target_message
   ctl_ioctl
   dm_ctl_ioctl
Kernel panic - not syncing: Fatal exception

Full excerpt is in crash_excerpt.txt in the attachment.

Impact
======

Privileged local DoS (CAP_SYS_ADMIN required for /dev/mapper/control).
NULL deref, not UAF — practical impact is denial of service under memory
pressure / fault injection on the @stats_create path.

Reproducer
==========

Attached: dm-stat-free-null-deref-repro.tar.gz

VM-only (do not run on a production host). Minimized C PoC: create a
zero-target DM device, resume, send @stats_create - 1024 while
fail_page_alloc is armed (fallback: memory hog). Guest needs >= 4 vCPUs.

Quick path (Docker + KVM):

   tar xzf dm-stat-free-null-deref-repro.tar.gz
   cd <extracted-dir>
   docker build -t dm-stat-free-null-deref -f Dockerfile .
   mkdir -p artifacts
   docker run --rm --privileged --device=/dev/kvm --network=host \
     -v "$PWD/artifacts:/artifacts" \
     -e OUTPUT_DIR=/artifacts \
     -e VM_MEMORY_MB=512 \
     -e VM_CPUS=4 \
     dm-stat-free-null-deref

Expected shortly after the PoC runs (first run also builds the kernel):

   KASAN: null-ptr-deref ... dm_stat_free
   Kernel panic - not syncing: Fatal exception

I am happy to test patches. Please let me know if you need more detail.

Thanks,
Yu Junzhe
FuzzAnything <fuzzanything@gmail.com>


[-- Attachment #2: dm-stat-free-null-deref-repro.tar.gz --]
[-- Type: application/x-gzip, Size: 11582 bytes --]

Re: [BUG] dm-stats: null-ptr-deref in dm_stat_free on stats alloc failure

[Mikulas Patocka]

On Sat, 25 Jul 2026, Junzhe Yu wrote:

> Hello,
> 
> I am reporting a null-pointer dereference in device-mapper dm-stats when
> @stats_create fails part-way through per-CPU buffer allocation.
> 
> Summary
> =======
> 
> dm_stats_create() allocates per-CPU stat buffers in a loop. On mid-loop
> ENOMEM it jumps to out: and calls dm_stat_free(). dm_stat_free() then
> dereferences s->stat_percpu[cpu] without a NULL check, including for CPUs
> that never received a successful allocation (still NULL from zero-init).
> 
> The crash is a KASAN null-ptr-deref / general protection fault in
> dm_stat_free() at drivers/md/dm-stats.c, reached via DM_TARGET_MSG
> @stats_create.

Hi

Here I'm sending a patch for this bug.

Mikulas


dm-stats: fix a crash if allocation of per-cpu data fails

If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code
jumps to the "out" label and calls dm_stat_free. dm_stat_free does
"for_each_possible_cpu(cpu) { dm_kvfree(s->stat_percpu[cpu][0].histogram,
s->histogram_alloc_size);", which crashes with NULL pointer dereference
if s->stat_percpu[cpu] is NULL.

This commit fixes the bug by testing s->stat_percpu[cpu] for NULL before
using it.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org

---
 drivers/md/dm-stats.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Index: linux-2.6/drivers/md/dm-stats.c
===================================================================
--- linux-2.6.orig/drivers/md/dm-stats.c	2026-07-13 20:58:56.000000000 +0200
+++ linux-2.6/drivers/md/dm-stats.c	2026-07-28 15:21:23.000000000 +0200
@@ -178,8 +178,10 @@ static void dm_stat_free(struct rcu_head
 	kfree(s->program_id);
 	kfree(s->aux_data);
 	for_each_possible_cpu(cpu) {
-		dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size);
-		dm_kvfree(s->stat_percpu[cpu], s->percpu_alloc_size);
+		if (s->stat_percpu[cpu]) {
+			dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size);
+			dm_kvfree(s->stat_percpu[cpu], s->percpu_alloc_size);
+		}
 	}
 	dm_kvfree(s->stat_shared[0].tmp.histogram, s->histogram_alloc_size);
 	dm_kvfree(s, s->shared_alloc_size);