From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C19B3B19BB for ; Tue, 28 Jul 2026 13:28:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785245295; cv=none; b=JbUl1E0Yp/KWSrsdzGeF/UhP+vqRKRoageP/uVDxiJr21YACx6ACYpIkdTINbKkNgTofncMstliAlgzwfnyCOD/RuBm4bf7yhusmlen80Wd6k9FEMBHCQW7MX2Vv57OeHMBo0MUsaH4PZWV80naE6Ge5woQJ7wLBTAIF2UqRGuA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785245295; c=relaxed/simple; bh=fJ7DUHTSm2Vkjty5O0sz0ismVjlvQrQzwa7sNhfvbkk=; h=Date:From:To:cc:Subject:In-Reply-To:Message-ID:References: MIME-Version:Content-Type; b=DA+1QIbO89Hsm1p8awWLFhRV2miTV/CQY5wBiVyKVa9RHcPec+m53TcYISKxlt/cJ127G8e2WhZyRNQM9t1r6mXYIwnwB55+/NLnZ6KNg/KwJVj0T0jgZixs+wdf7k3LnzPkbSb2mHrAYCV4pKku44MUA66/f2IqPeliEhoeQjM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=ang14RnM; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="ang14RnM" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785245292; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=qzYazpwyMpfKoBhnEBcrUPqBRejfl/tJUhCc/onywjE=; b=ang14RnM+sfqgOiz3DS+7ZDR6etAmaLJN+Djyc4dx1kOYbNbAXRiY1a+Gg1zOacef5Hr2H b8glaMFZnQIAEbyJ6qtEQR93uVMnNXdC5Y8TdkNwbzOojfiDjinETZzGVcCuOv2jq+BQeF pGcn3e8nj+xVRtXV74rtr1End+zwh2E= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-694-VEXpgC-nMweFLbLB2GVilQ-1; Tue, 28 Jul 2026 09:28:09 -0400 X-MC-Unique: VEXpgC-nMweFLbLB2GVilQ-1 X-Mimecast-MFC-AGG-ID: VEXpgC-nMweFLbLB2GVilQ_1785245288 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 5CA1A1955E74; Tue, 28 Jul 2026 13:28:06 +0000 (UTC) Received: from [10.44.32.225] (unknown [10.44.32.225]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 53B8F3000218; Tue, 28 Jul 2026 13:28:04 +0000 (UTC) Date: Tue, 28 Jul 2026 15:27:58 +0200 (CEST) From: Mikulas Patocka To: Junzhe Yu cc: Mike Snitzer , Benjamin Marzinski , Alasdair Kergon , dm-devel@lists.linux.dev, linux-kernel@vger.kernel.org Subject: Re: [BUG] dm-stats: null-ptr-deref in dm_stat_free on stats alloc failure In-Reply-To: <9c337692-ce94-4dfa-80db-47390f67f0b5@gmail.com> Message-ID: References: <9c337692-ce94-4dfa-80db-47390f67f0b5@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 On Sat, 25 Jul 2026, Junzhe Yu wrote: > Hello, > > I am reporting a null-pointer dereference in device-mapper dm-stats when > @stats_create fails part-way through per-CPU buffer allocation. > > Summary > ======= > > dm_stats_create() allocates per-CPU stat buffers in a loop. On mid-loop > ENOMEM it jumps to out: and calls dm_stat_free(). dm_stat_free() then > dereferences s->stat_percpu[cpu] without a NULL check, including for CPUs > that never received a successful allocation (still NULL from zero-init). > > The crash is a KASAN null-ptr-deref / general protection fault in > dm_stat_free() at drivers/md/dm-stats.c, reached via DM_TARGET_MSG > @stats_create. Hi Here I'm sending a patch for this bug. Mikulas dm-stats: fix a crash if allocation of per-cpu data fails If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code jumps to the "out" label and calls dm_stat_free. dm_stat_free does "for_each_possible_cpu(cpu) { dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size);", which crashes with NULL pointer dereference if s->stat_percpu[cpu] is NULL. This commit fixes the bug by testing s->stat_percpu[cpu] for NULL before using it. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org --- drivers/md/dm-stats.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) Index: linux-2.6/drivers/md/dm-stats.c =================================================================== --- linux-2.6.orig/drivers/md/dm-stats.c 2026-07-13 20:58:56.000000000 +0200 +++ linux-2.6/drivers/md/dm-stats.c 2026-07-28 15:21:23.000000000 +0200 @@ -178,8 +178,10 @@ static void dm_stat_free(struct rcu_head kfree(s->program_id); kfree(s->aux_data); for_each_possible_cpu(cpu) { - dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size); - dm_kvfree(s->stat_percpu[cpu], s->percpu_alloc_size); + if (s->stat_percpu[cpu]) { + dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size); + dm_kvfree(s->stat_percpu[cpu], s->percpu_alloc_size); + } } dm_kvfree(s->stat_shared[0].tmp.histogram, s->histogram_alloc_size); dm_kvfree(s, s->shared_alloc_size);