Race in aufs leads to use-after-free

[Kir Kolyshkin]

SRU Justification

Impact: A race in aufs can result in use of a DYNOP object which is being freed after its reference count reaches 0, leading to an oops.

Fix: Upstream fix to aufs to ignore objects whose reference count is 0.

Regression Potential: Low, limited to aufs and confirmed in testing to fix the issue.

---

I have found and reported a critical bug in aufs (as shipped with the latest Ubuntu kernels, both on Bionic and Xenial), which potentially affects anyone running Docker on Ubuntu using aufs graph driver. The fix has been developed, tested at least by me to fix the issue, and committed into upstream aufs git repos

The nature of the bug is, in case of multiple parallels aufs mounts and unmounts, the kernel can screw up krefs, and once that happens, the only remedy is to reboot it (as commands like mount/umount or cat /proc/mounts are all stuck in syscalls).

I would appreciate syncing aufs with the latest upstream release from git, as it was done a few times already, or at least taking the below fix (whatever suits maintainers better).

The fixed versions are the ones marked with 20190610, and from what I see they are available for all kernel versions since 4.14 (for example, 4.15 tree is here: https://github.com/sfjro/aufs4-standalone/commits/aufs4.15). For 4.4, a backport might be needed, but it should be trivial.

Original bug report: https://sourceforge.net/p/aufs/mailman/message/36680389/

Fix: https://github.com/sfjro/aufs4-linux/commit/b633d7b2635b9615fe294b85257d05008e3747a3

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1832795

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Kir Kolyshkin (kolyshkin)]

The nature of this bug is clear and it does not require any logs, so setting the status to "confirmed". In case anyone needs anything, please let me know and I'll do my best.

[Seth Forshee (sforshee)]

Thanks for the report, I will work on getting this fix into our kernels. Is there a simple way to test the fix?

[Kir Kolyshkin (kolyshkin)]

Thank you for looking! I'm afraid there is no easy/fast reproducer available, and as far as I remember it takes hours or days of stress testing to get to it. I can't think of any decent way to validate other than to check the aufs module version...

Once a kernel build is available, I can certainly give it some testing and report back in a few days (and/or provide you with detailed instructions about how to run the same tests I did).

[Seth Forshee (sforshee)]

Sorry for the delay, test builds are available at https://people.canonical.com/~sforshee/lp1832795. Please confirm that the bug is fixed, thanks!

[Seth Forshee (sforshee)]

Just checking in -- is it possible to get some testing with the test kernel in comment #5?