From: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
To: Yu Kuai <yukuai1@huaweicloud.com>
Cc: "jack@suse.cz" <jack@suse.cz>,
"paolo.valente@linaro.org" <paolo.valente@linaro.org>,
"axboe@kernel.dk" <axboe@kernel.dk>,
"glusvardi@posteo.net" <glusvardi@posteo.net>,
"damien.lemoal@opensource.wdc.com"
<damien.lemoal@opensource.wdc.com>,
"felicigb@gmail.com" <felicigb@gmail.com>,
"inbox@emilianomaccaferri.com" <inbox@emilianomaccaferri.com>,
"linux-block@vger.kernel.org" <linux-block@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"yukuai3@huawei.com" <yukuai3@huawei.com>,
"yi.zhang@huawei.com" <yi.zhang@huawei.com>,
"yangerkun@huawei.com" <yangerkun@huawei.com>
Subject: Re: [PATCH] block, bfq: fix uaf for 'stable_merge_bfqq'
Date: Wed, 8 Mar 2023 05:56:52 +0000 [thread overview]
Message-ID: <20230308055652.l3redb6gbb3pz3xp@shindev> (raw)
In-Reply-To: <20230308023208.379465-1-yukuai1@huaweicloud.com>
On Mar 08, 2023 / 10:32, Yu Kuai wrote:
> From: Yu Kuai <yukuai3@huawei.com>
>
> Before commit fd571df0ac5b ("block, bfq: turn bfqq_data into an array
> in bfq_io_cq"), process reference is read before bfq_put_stable_ref(),
> and it's safe if bfq_put_stable_ref() put the last reference, because
> process reference will be 0 and 'stable_merge_bfqq' won't be accessed
> in this case. However, the commit changed the order and will cause
> uaf for 'stable_merge_bfqq'.
>
> In order to emphasize that bfq_put_stable_ref() can drop the last
> reference, fix the problem by moving bfq_put_stable_ref() to the end of
> bfq_setup_stable_merge().
>
> Fixes: fd571df0ac5b ("block, bfq: turn bfqq_data into an array in bfq_io_cq")
> Reported-and-tested-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
> Link: https://lore.kernel.org/linux-block/20230307071448.rzihxbm4jhbf5krj@shindev/
> Signed-off-by: Yu Kuai <yukuai3@huawei.com>
> ---
> block/bfq-iosched.c | 18 +++++++++---------
> 1 file changed, 9 insertions(+), 9 deletions(-)
>
> diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
> index 8a8d4441519c..d9ed3108c17a 100644
> --- a/block/bfq-iosched.c
> +++ b/block/bfq-iosched.c
> @@ -2854,11 +2854,11 @@ bfq_setup_stable_merge(struct bfq_data *bfqd, struct bfq_queue *bfqq,
> {
> int proc_ref = min(bfqq_process_refs(bfqq),
> bfqq_process_refs(stable_merge_bfqq));
> - struct bfq_queue *new_bfqq;
> + struct bfq_queue *new_bfqq = NULL;
>
> - if (idling_boosts_thr_without_issues(bfqd, bfqq) ||
> - proc_ref == 0)
> - return NULL;
> + bfqq_data->stable_merge_bfqq = NULL;
> + if (idling_boosts_thr_without_issues(bfqd, bfqq) || proc_ref == 0)
> + goto out;
>
> /* next function will take at least one ref */
> new_bfqq = bfq_setup_merge(bfqq, stable_merge_bfqq);
> @@ -2873,6 +2873,11 @@ bfq_setup_stable_merge(struct bfq_data *bfqd, struct bfq_queue *bfqq,
> new_bfqq_data->stably_merged = true;
> }
> }
> +
> +out:
> + /* deschedule stable merge, because done or aborted here */
> + bfq_put_stable_ref(stable_merge_bfqq);
> +
> return new_bfqq;
> }
>
> @@ -2933,11 +2938,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
> struct bfq_queue *stable_merge_bfqq =
> bfqq_data->stable_merge_bfqq;
Nit: I suggest to remove the local variable above. The two references to it
below are removed, and the argument of bfq_setup_stable_merge() can be replaced
with bfqq_data->stable_merge_bfqq.
>
> - /* deschedule stable merge, because done or aborted here */
> - bfq_put_stable_ref(stable_merge_bfqq);
> -
> - bfqq_data->stable_merge_bfqq = NULL;
> -
> return bfq_setup_stable_merge(bfqd, bfqq,
> stable_merge_bfqq,
> bfqq_data);
> --
> 2.31.1
>
--
Shin'ichiro Kawasaki
next prev parent reply other threads:[~2023-03-08 5:57 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-07 7:14 [bug report] BUG: KASAN: slab-use-after-free in bfq_setup_cooperator Shinichiro Kawasaki
2023-03-07 8:57 ` Yu Kuai
2023-03-07 9:13 ` Shinichiro Kawasaki
2023-03-07 9:36 ` Yu Kuai
2023-03-07 10:20 ` Jan Kara
2023-03-07 10:28 ` Yu Kuai
2023-03-07 11:49 ` Shinichiro Kawasaki
2023-03-07 14:26 ` Jens Axboe
2023-03-08 2:32 ` [PATCH] block, bfq: fix uaf for 'stable_merge_bfqq' Yu Kuai
2023-03-08 5:56 ` Shinichiro Kawasaki [this message]
2023-03-08 10:21 ` Jan Kara
2023-03-08 14:35 ` Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230308055652.l3redb6gbb3pz3xp@shindev \
--to=shinichiro.kawasaki@wdc.com \
--cc=axboe@kernel.dk \
--cc=damien.lemoal@opensource.wdc.com \
--cc=felicigb@gmail.com \
--cc=glusvardi@posteo.net \
--cc=inbox@emilianomaccaferri.com \
--cc=jack@suse.cz \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=paolo.valente@linaro.org \
--cc=yangerkun@huawei.com \
--cc=yi.zhang@huawei.com \
--cc=yukuai1@huaweicloud.com \
--cc=yukuai3@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.