From patchwork Wed Nov 30 13:21:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Li Nan X-Patchwork-Id: 27787 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp909620wrr; Wed, 30 Nov 2022 05:02:42 -0800 (PST) X-Google-Smtp-Source: AA0mqf7unij4qKLKPGEoT9Uu8PExrevNTANOpXZHbNdDshM5u8YmNi7/Z6V6UWMqz7AXgpkTpb40 X-Received: by 2002:a17:90a:c795:b0:218:9893:9aa7 with SMTP id gn21-20020a17090ac79500b0021898939aa7mr52775991pjb.223.1669813362331; Wed, 30 Nov 2022 05:02:42 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669813362; cv=none; d=google.com; s=arc-20160816; b=GLU52sPq9H+8lNAklxW4gv6L4514ZZ97Jm5pEA3x3JTCaIbQlLq0cXMAvZ3nxDmbq1 PFpGTGAZeSmkNyMkOO5y72Y38EFaPaoSffBT875hk8PNCh9P64KCNhKVcyNvocZnxeB/ P0tfFLghC7XuBr2KrCus0FCHuerFcUSgoJhwO9QpF9xxTV8JamNMFKbeOYKxhw35ZIWl bLjrkvAf4KAcg9sGm55IgCnDdip07OS0dQYR54iAI9VuWeXdS1gXLt/d3/PR7t/+0uUw OlTxRpkEtqTKuMTvdrJJRd+IftU4+qCJsa5LLShS0b2uiTEOWLyLM0JSz4fkMfitwv60 yuYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=ux/u74cTCHbFFg1rxGvp+JsiH9rX2KPf2tvkKgm4PjY=; b=sc1yVAsfJA8jd20lfs0usU6LzSRJIMaTyhkdiwbgcuWJbGaAIbtvV8jdJt0qtM6cfZ 3yK8mZoWJKyDEo8/yqaTnISI2uhL6igw8eHksOXy/TZWia5+/mcI8xeJ8rO/XEbB/XQU Co29/8QGar7AxtntbCnngD2W1xwV1pSYUlmy6v/ZPA97t7eUUk6o4J3Ef5QTgcPHq3re I4DmxdSs0rFRcwZmSU6ZbEz6556OMQJbwQbvR3WIMG9I6VnSufnU8YxuDnQyA1hDiUAp pc07Bxdve0BEG6qsrENCEZQEB/pnWxsyMiHSH7afOLhD5CTOuYfmWL3g0QcslDgj+m1j +lLQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 205-20020a6305d6000000b0046fc9e82c99si1225072pgf.206.2022.11.30.05.02.26; Wed, 30 Nov 2022 05:02:42 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235773AbiK3NBb (ORCPT + 99 others); Wed, 30 Nov 2022 08:01:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41438 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234023AbiK3NA6 (ORCPT ); Wed, 30 Nov 2022 08:00:58 -0500 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F24ED52170; Wed, 30 Nov 2022 05:00:55 -0800 (PST) Received: from dggpeml500022.china.huawei.com (unknown [172.30.72.55]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4NMfSY6G8xzRpYq; Wed, 30 Nov 2022 21:00:13 +0800 (CST) Received: from dggpeml500003.china.huawei.com (7.185.36.200) by dggpeml500022.china.huawei.com (7.185.36.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Wed, 30 Nov 2022 21:00:54 +0800 Received: from huawei.com (10.175.127.227) by dggpeml500003.china.huawei.com (7.185.36.200) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Wed, 30 Nov 2022 21:00:53 +0800 From: Li Nan To: , , CC: , , , , , Subject: [PATCH -next v2 7/9] blk-iocost: fix UAF in ioc_pd_free Date: Wed, 30 Nov 2022 21:21:54 +0800 Message-ID: <20221130132156.2836184-8-linan122@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221130132156.2836184-1-linan122@huawei.com> References: <20221130132156.2836184-1-linan122@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.175.127.227] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To dggpeml500003.china.huawei.com (7.185.36.200) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750926216579854290?= X-GMAIL-MSGID: =?utf-8?q?1750926216579854290?= Our test found the following problem in kernel 5.10, and the same problem should exist in mainline: BUG: KASAN: use-after-free in _raw_spin_lock_irqsave+0x71/0xe0 Write of size 4 at addr ffff8881432000e0 by task swapper/4/0 ... Call Trace: dump_stack+0x9c/0xd3 print_address_description.constprop.0+0x19/0x170 __kasan_report.cold+0x6c/0x84 kasan_report+0x3a/0x50 check_memory_region+0xfd/0x1f0 _raw_spin_lock_irqsave+0x71/0xe0 ioc_pd_free+0x9d/0x250 blkg_free.part.0+0x80/0x100 __blkg_release+0xf3/0x1c0 rcu_do_batch+0x292/0x700 rcu_core+0x270/0x2d0 __do_softirq+0xfd/0x402 asm_call_irq_on_stack+0x12/0x20 do_softirq_own_stack+0x37/0x50 irq_exit_rcu+0x134/0x1a0 sysvec_apic_timer_interrupt+0x36/0x80 asm_sysvec_apic_timer_interrupt+0x12/0x20 Freed by task 57: kfree+0xba/0x680 rq_qos_exit+0x5a/0x80 blk_cleanup_queue+0xce/0x1a0 virtblk_remove+0x77/0x130 [virtio_blk] virtio_dev_remove+0x56/0xe0 __device_release_driver+0x2ba/0x450 device_release_driver+0x29/0x40 bus_remove_device+0x1d8/0x2c0 device_del+0x333/0x7e0 device_unregister+0x27/0x90 unregister_virtio_device+0x22/0x40 virtio_pci_remove+0x53/0xb0 pci_device_remove+0x7a/0x130 __device_release_driver+0x2ba/0x450 device_release_driver+0x29/0x40 pci_stop_bus_device+0xcf/0x100 pci_stop_and_remove_bus_device+0x16/0x20 disable_slot+0xa1/0x110 acpiphp_disable_and_eject_slot+0x35/0xe0 hotplug_event+0x1b8/0x3c0 acpiphp_hotplug_notify+0x37/0x70 acpi_device_hotplug+0xee/0x320 acpi_hotplug_work_fn+0x69/0x80 process_one_work+0x3c5/0x730 worker_thread+0x93/0x650 kthread+0x1ba/0x210 ret_from_fork+0x22/0x30 It happened as follow: T1 T2 T3 //delete device del_gendisk bdi_unregister bdi_remove_from_list synchronize_rcu_expedited //rmdir cgroup blkcg_destroy_blkgs blkg_destroy percpu_ref_kill blkg_release call_rcu rq_qos_exit ioc_rqos_exit kfree(ioc) __blkg_release blkg_free blkg_free_workfn pd_free_fn ioc_pd_free spin_lock_irqsave ->ioc is freed Fix the problem by moving the operation on ioc in ioc_pd_free() to ioc_pd_offline(), and just free resource in ioc_pd_free() like iolatency and throttle. Signed-off-by: Li Nan Acked-by: Tejun Heo --- block/blk-iocost.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index 2316ba93e7d6..710cf63a1643 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -2978,7 +2978,7 @@ static void ioc_pd_init(struct blkg_policy_data *pd) spin_unlock_irqrestore(&ioc->lock, flags); } -static void ioc_pd_free(struct blkg_policy_data *pd) +static void ioc_pd_offline(struct blkg_policy_data *pd) { struct ioc_gq *iocg = pd_to_iocg(pd); struct ioc *ioc = iocg->ioc; @@ -3002,6 +3002,12 @@ static void ioc_pd_free(struct blkg_policy_data *pd) hrtimer_cancel(&iocg->waitq_timer); } +} + +static void ioc_pd_free(struct blkg_policy_data *pd) +{ + struct ioc_gq *iocg = pd_to_iocg(pd); + free_percpu(iocg->pcpu_stat); kfree(iocg); } @@ -3488,6 +3494,7 @@ static struct blkcg_policy blkcg_policy_iocost = { .cpd_free_fn = ioc_cpd_free, .pd_alloc_fn = ioc_pd_alloc, .pd_init_fn = ioc_pd_init, + .pd_offline_fn = ioc_pd_offline, .pd_free_fn = ioc_pd_free, .pd_stat_fn = ioc_pd_stat, };