From patchwork Wed Jan 18 12:31:50 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu Kuai X-Patchwork-Id: 45236 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp2316808wrn; Wed, 18 Jan 2023 04:48:37 -0800 (PST) X-Google-Smtp-Source: AMrXdXvpGWauGRvwjiC7P7ex5hkuwiVUosy36eRugdvn6gyDwHlEXJPA30xOnijcej+F3VY6UtrI X-Received: by 2002:a17:90b:23d3:b0:223:b1e4:146 with SMTP id md19-20020a17090b23d300b00223b1e40146mr6745007pjb.37.1674046117549; Wed, 18 Jan 2023 04:48:37 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1674046117; cv=none; d=google.com; s=arc-20160816; b=MiqiiPj2vh1B5u+p3L24jsG4BtSrxYvaFwP8d0YzvZQPpSEU5fjtLoFjrRdu2RlvpI rkI6OiF71jl/s5KTnPAjSmbHRoOJToKgvemtSXQLUn8ztUiYK255/IkDFX6eXlhjrLf4 md9xKV82OMz6RoY6QLMMOuPCmy3osXiUzviWN5i8jnwQcJnk1xSVNLJ7tlzjbweG59S2 rCmNSACKcQR2EpRG20jROiAC2xc+P3maYmHYbhG6cAy0ArQsMRMuqMO3R4xMneoKGVDy MsmbyOhZYAev6nIkBsbl146b6JnDoPuThu73i1vMG1SWrLOvAK7NKxVVB6p57BUAK75M N8MQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=k69h0x8LLZYnWg764w8d52wv7ZrjFH1OosCT+DhJjSQ=; b=sObxYTktXDthJ45TQ0yZ3UITq9BtTH450LVzqluSCzQKyPT6jFEkjGrwFPjQWgdbSC ZUbTEXhw8hQWQiIgdQ3BVluaKeGZ2q47Ry7w1Ku5/RJSS5PljFyzveQgsdeHsTEoqO3X VETrcC3MywZl8gaOBxr19BRgzclkxKZ5DtRtn3j/OoS0nXZQ2ZNo/kUpZyAxysun3chF jdMGaDspO9nKwRoeVpWhXSpFGr98oT51JThKBZoBmJyvNStsH/GJKsVMnrfIhZkEDBgj 0EdtwF9JjBYHQnqvjA70VI/k4Gjpn/XaidI0ha0tcC/H76eiAqgN9s27IjC85htY1pNo QeXg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id d9-20020a631d09000000b004c5936dd6e1si16692156pgd.201.2023.01.18.04.48.24; Wed, 18 Jan 2023 04:48:37 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230311AbjARMpq (ORCPT + 99 others); Wed, 18 Jan 2023 07:45:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44720 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230426AbjARMnX (ORCPT ); Wed, 18 Jan 2023 07:43:23 -0500 Received: from dggsgout11.his.huawei.com (dggsgout11.his.huawei.com [45.249.212.51]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EF0BD1042E; Wed, 18 Jan 2023 04:07:41 -0800 (PST) Received: from mail02.huawei.com (unknown [172.30.67.143]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTP id 4NxkzC1z5fz4f41Fj; Wed, 18 Jan 2023 20:07:35 +0800 (CST) Received: from huaweicloud.com (unknown [10.175.127.227]) by APP3 (Coremail) with SMTP id _Ch0CgCHgR8G4cdjY2MdBw--.48220S5; Wed, 18 Jan 2023 20:07:37 +0800 (CST) From: Yu Kuai To: tj@kernel.org, hch@lst.de, josef@toxicpanda.com, axboe@kernel.dk Cc: cgroups@vger.kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, yukuai3@huawei.com, yukuai1@huaweicloud.com, yi.zhang@huawei.com, yangerkun@huawei.com Subject: [PATCH -next v2 1/3] blk-cgroup: dropping parent refcount after pd_free_fn() is done Date: Wed, 18 Jan 2023 20:31:50 +0800 Message-Id: <20230118123152.1926314-2-yukuai1@huaweicloud.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20230118123152.1926314-1-yukuai1@huaweicloud.com> References: <20230118123152.1926314-1-yukuai1@huaweicloud.com> MIME-Version: 1.0 X-CM-TRANSID: _Ch0CgCHgR8G4cdjY2MdBw--.48220S5 X-Coremail-Antispam: 1UD129KBjvJXoW7AF1kGF4DuFW5Ar4xCr4rZrb_yoW8Wr4Upa nxKr45KrWFgF1qva17t3WDX34rCF4rG348GrWrGa1Fkry3Cryv9Fn5Ars5XFWFvFZ7JFW5 Zr4vqa4UJa1jkaDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUBE14x267AKxVW5JVWrJwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2048vs2IY020E87I2jVAFwI0_Jr4l82xGYIkIc2 x26xkF7I0E14v26r4j6ryUM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0 Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr1j6F4UJw A2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oVCq3wAS 0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2 IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0 Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628vn2kIc2 xKxwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14v2 6r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GFylIxkGc2 Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_ Gr0_Cr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMI IF0xvEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x0JU2_M3UUUUU = X-CM-SenderInfo: 51xn3trlr6x35dzhxuhorxvhhfrp/ X-CFilter-Loop: Reflected X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_HELO_NONE, SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1755364581661478701?= X-GMAIL-MSGID: =?utf-8?q?1755364581661478701?= From: Yu Kuai Some cgroup policies will access parent pd through child pd even after pd_offline_fn() is done. If pd_free_fn() for parent is called before child, then UAF can be triggered. Hence it's better to guarantee the order of pd_free_fn(). Currently refcount of parent blkg is dropped in __blkg_release(), which is before pd_free_fn() is called in blkg_free_work_fn() while blkg_free_work_fn() is called asynchronously. This patch make sure pd_free_fn() called from removing cgroup is ordered by delaying dropping parent refcount after calling pd_free_fn() for child. BTW, pd_free_fn() will also be called from blkcg_deactivate_policy() from deleting device, and following patches will guarantee the order. Signed-off-by: Yu Kuai Acked-by: Tejun Heo --- block/blk-cgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 4c94a6560f62..c6d7d1fce65a 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -124,6 +124,8 @@ static void blkg_free_workfn(struct work_struct *work) if (blkg->pd[i]) blkcg_policy[i]->pd_free_fn(blkg->pd[i]); + if (blkg->parent) + blkg_put(blkg->parent); if (blkg->q) blk_put_queue(blkg->q); free_percpu(blkg->iostat_cpu); @@ -158,8 +160,6 @@ static void __blkg_release(struct rcu_head *rcu) /* release the blkcg and parent blkg refs this blkg has been holding */ css_put(&blkg->blkcg->css); - if (blkg->parent) - blkg_put(blkg->parent); blkg_free(blkg); } From patchwork Wed Jan 18 12:31:51 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu Kuai X-Patchwork-Id: 45234 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp2316026wrn; Wed, 18 Jan 2023 04:46:51 -0800 (PST) X-Google-Smtp-Source: AMrXdXuznjJr2C1loBUWW5oeShPE1qPFpj0f7e/rD5F4736v7ff4SCSgNI9A3r2NCNO7svRFsjhK X-Received: by 2002:aa7:8515:0:b0:58d:aae3:bcc1 with SMTP id v21-20020aa78515000000b0058daae3bcc1mr5866582pfn.5.1674046011290; Wed, 18 Jan 2023 04:46:51 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1674046011; cv=none; d=google.com; s=arc-20160816; b=FdQan6ZOHbnuQAMCWW4CKEv5+Gk6x00eSU46RL+AIPwkYlpwLkRmr4568bnnErkC/M pHQZtKbmQzQ+kgDCJlBjbVfOPZnSxmk9kRvoYEGYM4m13W5Y6CCNMxw5OareKWRLfL3i EVO2wF8wvRwl8nGGAtDsryz6bS5e0RVzVAXXB+39QBk5vv/L1mTgvCZS+rwc88bsQYlt GSm5TfzvcFaHL9UBcYHVj/DzvGezr1ceFjYVIium1/9ltLvO72oXFGCiiywfMokXs3Gv PAVyU9iY0ngJH7SfWbvhyUAS4wD1HBdxtNytJyk4aubcWluNTh7H6iukRbFkTrCCunZH 8a6A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=qs7g6BVlacHfJ7QnUJAkHgTVgNiLb4r06Q6uAFqMlFc=; b=w3Lj8uIb6GxtWdUIG376ga6ZQhQh8b8GzzVYI9amDaZByoJ2dvug4VZiBkNHHpjmEq 3JQA/2fMqrqSb+EK2vKPLDdoQBJjzdlonnb1IoRB8o8keyaqVG4nb09aUxCAUREe2AHo NsvBTPz894+igud+44vpUIBAtwBr1OrnH4NBowisKiOtOn1cHwEi69Qb2xQ76NkbqhSG iaK5Jw1BLcl8byvsK5Akv1iGtZ0WITQz7oO4obsXB1it2/QHXA6v86yUfyItGxZ8Pv1t X497RP9zH72cE1csFOV7XRVekIZi+m2BHD7/hlI+O7toaPVtpndg4zn+Qg8RGLdr/95y wGEQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id z15-20020aa7888f000000b0058dcade7ea6si5300874pfe.332.2023.01.18.04.46.33; Wed, 18 Jan 2023 04:46:51 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230290AbjARMpg (ORCPT + 99 others); Wed, 18 Jan 2023 07:45:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44712 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230430AbjARMnX (ORCPT ); Wed, 18 Jan 2023 07:43:23 -0500 Received: from dggsgout11.his.huawei.com (dggsgout11.his.huawei.com [45.249.212.51]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EF2E710A80; Wed, 18 Jan 2023 04:07:41 -0800 (PST) Received: from mail02.huawei.com (unknown [172.30.67.143]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTP id 4NxkzC5CYvz4f43Lx; Wed, 18 Jan 2023 20:07:35 +0800 (CST) Received: from huaweicloud.com (unknown [10.175.127.227]) by APP3 (Coremail) with SMTP id _Ch0CgCHgR8G4cdjY2MdBw--.48220S6; Wed, 18 Jan 2023 20:07:38 +0800 (CST) From: Yu Kuai To: tj@kernel.org, hch@lst.de, josef@toxicpanda.com, axboe@kernel.dk Cc: cgroups@vger.kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, yukuai3@huawei.com, yukuai1@huaweicloud.com, yi.zhang@huawei.com, yangerkun@huawei.com Subject: [PATCH -next v2 2/3] blk-cgroup: support to track if policy is online Date: Wed, 18 Jan 2023 20:31:51 +0800 Message-Id: <20230118123152.1926314-3-yukuai1@huaweicloud.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20230118123152.1926314-1-yukuai1@huaweicloud.com> References: <20230118123152.1926314-1-yukuai1@huaweicloud.com> MIME-Version: 1.0 X-CM-TRANSID: _Ch0CgCHgR8G4cdjY2MdBw--.48220S6 X-Coremail-Antispam: 1UD129KBjvJXoWxGFWxXFy3JF43Zw4UZry3CFg_yoWrJw15pF 43Kry5J34Iyr18CFWjv3WUWryaga1rt34UAFW3Cws0kF17trnrZ3WDZayDArZayFZruF45 WF18tayUGw45CFDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUBE14x267AKxVWrJVCq3wAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2048vs2IY020E87I2jVAFwI0_Jryl82xGYIkIc2 x26xkF7I0E14v26ryj6s0DM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0 Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr1j6F4UJw A2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oVCq3wAS 0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2 IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0 Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628vn2kIc2 xKxwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14v2 6r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GFylIxkGc2 Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_ Gr0_Cr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMI IF0xvEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x0JUHbyAUUUUU = X-CM-SenderInfo: 51xn3trlr6x35dzhxuhorxvhhfrp/ X-CFilter-Loop: Reflected X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_HELO_NONE, SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1755364470239464652?= X-GMAIL-MSGID: =?utf-8?q?1755364470239464652?= From: Yu Kuai A new field 'online' is added to blkg_policy_date to fix following 2 problem: 1) In blkcg_activate_policy(), if pd_alloc_fn() with 'GFP_NOWAIT' failed, 'queue_lock' will be dropped and pd_alloc_fn() will try again without 'GFP_NOWAIT'. In the meantime, remove cgroup can race with it, and pd_offline_fn() will be called without pd_init_fn() and pd_online_fn(). This way null-ptr-deference can be triggered. 2) In order to synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy(), 'list_del_init(&blkg->q_node)' will be delayed to blkg_free_workfn(), hence pd_offline_fn() can be called first in blkg_destroy(), and then blkcg_deactivate_policy() will call it again, we must prevent it. The new field 'online' will be set after pd_online_fn() and will be cleared after pd_offline_fn(), in the meantime pd_offline_fn() will only be called if 'online' is set. Signed-off-by: Yu Kuai Acked-by: Tejun Heo --- block/blk-cgroup.c | 24 +++++++++++++++++------- block/blk-cgroup.h | 1 + 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index c6d7d1fce65a..75f3c4460715 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -288,6 +288,7 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct gendisk *disk, blkg->pd[i] = pd; pd->blkg = blkg; pd->plid = i; + pd->online = false; } return blkg; @@ -359,8 +360,11 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg, struct gendisk *disk, for (i = 0; i < BLKCG_MAX_POLS; i++) { struct blkcg_policy *pol = blkcg_policy[i]; - if (blkg->pd[i] && pol->pd_online_fn) - pol->pd_online_fn(blkg->pd[i]); + if (blkg->pd[i]) { + if (pol->pd_online_fn) + pol->pd_online_fn(blkg->pd[i]); + blkg->pd[i]->online = true; + } } } blkg->online = true; @@ -465,8 +469,11 @@ static void blkg_destroy(struct blkcg_gq *blkg) for (i = 0; i < BLKCG_MAX_POLS; i++) { struct blkcg_policy *pol = blkcg_policy[i]; - if (blkg->pd[i] && pol->pd_offline_fn) - pol->pd_offline_fn(blkg->pd[i]); + if (blkg->pd[i] && blkg->pd[i]->online) { + if (pol->pd_offline_fn) + pol->pd_offline_fn(blkg->pd[i]); + blkg->pd[i]->online = false; + } } blkg->online = false; @@ -1448,6 +1455,7 @@ int blkcg_activate_policy(struct request_queue *q, blkg->pd[pol->plid] = pd; pd->blkg = blkg; pd->plid = pol->plid; + pd->online = false; } /* all allocated, init in the same order */ @@ -1455,9 +1463,11 @@ int blkcg_activate_policy(struct request_queue *q, list_for_each_entry_reverse(blkg, &q->blkg_list, q_node) pol->pd_init_fn(blkg->pd[pol->plid]); - if (pol->pd_online_fn) - list_for_each_entry_reverse(blkg, &q->blkg_list, q_node) + list_for_each_entry_reverse(blkg, &q->blkg_list, q_node) { + if (pol->pd_online_fn) pol->pd_online_fn(blkg->pd[pol->plid]); + blkg->pd[pol->plid]->online = true; + } __set_bit(pol->plid, q->blkcg_pols); ret = 0; @@ -1519,7 +1529,7 @@ void blkcg_deactivate_policy(struct request_queue *q, spin_lock(&blkcg->lock); if (blkg->pd[pol->plid]) { - if (pol->pd_offline_fn) + if (blkg->pd[pol->plid]->online && pol->pd_offline_fn) pol->pd_offline_fn(blkg->pd[pol->plid]); pol->pd_free_fn(blkg->pd[pol->plid]); blkg->pd[pol->plid] = NULL; diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h index 1e94e404eaa8..b13ee84f358e 100644 --- a/block/blk-cgroup.h +++ b/block/blk-cgroup.h @@ -135,6 +135,7 @@ struct blkg_policy_data { /* the blkg and policy id this per-policy data belongs to */ struct blkcg_gq *blkg; int plid; + bool online; }; /* From patchwork Wed Jan 18 12:31:52 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu Kuai X-Patchwork-Id: 45235 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp2316125wrn; Wed, 18 Jan 2023 04:47:06 -0800 (PST) X-Google-Smtp-Source: AMrXdXvfWM6ZPdd6cWlZedHY132FSvwXf+t259KjOJ3I6fbl4plKiOvkVCync1EQJ4QR1AC9piB2 X-Received: by 2002:a05:6a20:d2cd:b0:a2:c3b0:f637 with SMTP id ir13-20020a056a20d2cd00b000a2c3b0f637mr7258916pzb.26.1674046025811; Wed, 18 Jan 2023 04:47:05 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1674046025; cv=none; d=google.com; s=arc-20160816; b=ASy1ZL5WOXnnGfKgpNsFV+8d8KufNHDdACBcAQen0q4WQ57fNR2K/MaT3CH87MCo8N j1BT2b+Hc4pyKgXBnHHhSAsW6y5LZ5G2tiTOGwA0gd+jsmQJZ4Q5MA+rC1SAj2A87tKQ FbJtaZX/3Wh/FRnbOXCE7w/y165FTzFtrX7u5sU0DkOghyFkkKHGF9tVlqV4A4zw5PnM uFbdx/yijpmDUoYoMyGCLXQZ/e+QCqE7ghobpV3FAe9PyMSPiPGdyPb3ieLy3bF4Lg4b GUoBlbpU2M6+vEqfvhO77Hw6QRNGJ1LntXvyB8wbOyFmo7p68GO53lNGQUE5kmmyD/1o 3SmQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=j6II6ie2KAhYn5a1N+GPk9SRwG5PBocbZFNBnGnJqKA=; b=z+V9+RPUboKkyZlvaQohgKN0rf0Va1byynTeiFRaiPYfC2lNsjZk5cL4G8pTDOb37r LIj3heNL5pkvlvaMIk0JctznUZHjzc7sJe8xbMKmDADuZBGm/tN24hcBCSJrFU5ZQGJh Ii+cAOBdYKCehkDXLInhSOa0CWYcsO4MG5Y5WyEcX5gVt6gyBDglbB6yhROibH7sXKCH RvuzxH4lgRjry91Rs52Cti1lWF1qyO6rUM6+41uY4CGEc2YbMB1ZWH1f2aJZXw5J9z5q EwF4R/fi7VqYoxGhyqDywnI6wzwWx3BO5vEJo/a6cpZwij7SGQPh3iDLcaH1IM5J+PiN s5EA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id q11-20020a6557cb000000b00491ad1ca2f1si35961661pgr.836.2023.01.18.04.46.51; Wed, 18 Jan 2023 04:47:05 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230471AbjARMpv (ORCPT + 99 others); Wed, 18 Jan 2023 07:45:51 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230437AbjARMn2 (ORCPT ); Wed, 18 Jan 2023 07:43:28 -0500 Received: from dggsgout12.his.huawei.com (unknown [45.249.212.56]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E1C5610ABE; Wed, 18 Jan 2023 04:07:42 -0800 (PST) Received: from mail02.huawei.com (unknown [172.30.67.143]) by dggsgout12.his.huawei.com (SkyGuard) with ESMTP id 4NxkzD0qL4z4f3p1W; Wed, 18 Jan 2023 20:07:36 +0800 (CST) Received: from huaweicloud.com (unknown [10.175.127.227]) by APP3 (Coremail) with SMTP id _Ch0CgCHgR8G4cdjY2MdBw--.48220S7; Wed, 18 Jan 2023 20:07:38 +0800 (CST) From: Yu Kuai To: tj@kernel.org, hch@lst.de, josef@toxicpanda.com, axboe@kernel.dk Cc: cgroups@vger.kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, yukuai3@huawei.com, yukuai1@huaweicloud.com, yi.zhang@huawei.com, yangerkun@huawei.com Subject: [PATCH -next v2 3/3] blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy() Date: Wed, 18 Jan 2023 20:31:52 +0800 Message-Id: <20230118123152.1926314-4-yukuai1@huaweicloud.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20230118123152.1926314-1-yukuai1@huaweicloud.com> References: <20230118123152.1926314-1-yukuai1@huaweicloud.com> MIME-Version: 1.0 X-CM-TRANSID: _Ch0CgCHgR8G4cdjY2MdBw--.48220S7 X-Coremail-Antispam: 1UD129KBjvJXoWxAF4DZr45ZF1xGryrGFy3urg_yoWrWF48pF ZxGFZxtrWSgr4xZF45Wr17ur93Ka18KrWUGayxKay5Cr4Yvr4vqFnrZFWkAFWxAF4kJr43 Ar4jgFs8Kr4UCwUanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUBE14x267AKxVWrJVCq3wAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2048vs2IY020E87I2jVAFwI0_JrWl82xGYIkIc2 x26xkF7I0E14v26ryj6s0DM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0 Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr1j6F4UJw A2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oVCq3wAS 0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2 IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0 Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628vn2kIc2 xKxwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14v2 6r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GFylIxkGc2 Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_ Gr0_Cr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMI IF0xvEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x0JUd8n5UUUUU = X-CM-SenderInfo: 51xn3trlr6x35dzhxuhorxvhhfrp/ X-CFilter-Loop: Reflected X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,KHOP_HELO_FCRDNS, SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1755364486010476715?= X-GMAIL-MSGID: =?utf-8?q?1755364486010476715?= From: Yu Kuai Currently parent pd can be freed before child pd: t1: remove cgroup C1 blkcg_destroy_blkgs blkg_destroy list_del_init(&blkg->q_node) // remove blkg from queue list percpu_ref_kill(&blkg->refcnt) blkg_release call_rcu t2: from t1 __blkg_release blkg_free schedule_work t4: deactivate policy blkcg_deactivate_policy pd_free_fn // parent of C1 is freed first t3: from t2 blkg_free_workfn pd_free_fn If policy(for example, ioc_timer_fn() from iocost) access parent pd from child pd after pd_offline_fn(), then UAF can be triggered. Fix the problem by delaying 'list_del_init(&blkg->q_node)' from blkg_destroy() to blkg_free_workfn(), and use a new disk level mutex to protect blkg_free_workfn() and blkcg_deactivate_policy). Signed-off-by: Yu Kuai --- block/blk-cgroup.c | 33 +++++++++++++++++++++++++++------ include/linux/blkdev.h | 1 + 2 files changed, 28 insertions(+), 6 deletions(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 75f3c4460715..4098e8030e01 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -118,16 +118,26 @@ static void blkg_free_workfn(struct work_struct *work) { struct blkcg_gq *blkg = container_of(work, struct blkcg_gq, free_work); + struct request_queue *q = blkg->q; int i; + if (q) + mutex_lock(&q->blkcg_mutex); + for (i = 0; i < BLKCG_MAX_POLS; i++) if (blkg->pd[i]) blkcg_policy[i]->pd_free_fn(blkg->pd[i]); if (blkg->parent) blkg_put(blkg->parent); - if (blkg->q) - blk_put_queue(blkg->q); + + if (q) { + if (!list_empty(&blkg->q_node)) + list_del_init(&blkg->q_node); + mutex_unlock(&q->blkcg_mutex); + blk_put_queue(q); + } + free_percpu(blkg->iostat_cpu); percpu_ref_exit(&blkg->refcnt); kfree(blkg); @@ -462,9 +472,14 @@ static void blkg_destroy(struct blkcg_gq *blkg) lockdep_assert_held(&blkg->q->queue_lock); lockdep_assert_held(&blkcg->lock); - /* Something wrong if we are trying to remove same group twice */ - WARN_ON_ONCE(list_empty(&blkg->q_node)); - WARN_ON_ONCE(hlist_unhashed(&blkg->blkcg_node)); + /* + * blkg is removed from queue list in blkg_free_workfn(), hence this + * function can be called from blkcg_destroy_blkgs() first, and then + * before blkg_free_workfn(), this function can be called again in + * blkg_destroy_all(). + */ + if (hlist_unhashed(&blkg->blkcg_node)) + return; for (i = 0; i < BLKCG_MAX_POLS; i++) { struct blkcg_policy *pol = blkcg_policy[i]; @@ -478,8 +493,11 @@ static void blkg_destroy(struct blkcg_gq *blkg) blkg->online = false; + /* + * Delay deleting list blkg->q_node to blkg_free_workfn() to synchronize + * pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy(). + */ radix_tree_delete(&blkcg->blkg_tree, blkg->q->id); - list_del_init(&blkg->q_node); hlist_del_init_rcu(&blkg->blkcg_node); /* @@ -1280,6 +1298,7 @@ int blkcg_init_disk(struct gendisk *disk) int ret; INIT_LIST_HEAD(&q->blkg_list); + mutex_init(&q->blkcg_mutex); new_blkg = blkg_alloc(&blkcg_root, disk, GFP_KERNEL); if (!new_blkg) @@ -1520,6 +1539,7 @@ void blkcg_deactivate_policy(struct request_queue *q, if (queue_is_mq(q)) blk_mq_freeze_queue(q); + mutex_lock(&q->blkcg_mutex); spin_lock_irq(&q->queue_lock); __clear_bit(pol->plid, q->blkcg_pols); @@ -1538,6 +1558,7 @@ void blkcg_deactivate_policy(struct request_queue *q, } spin_unlock_irq(&q->queue_lock); + mutex_unlock(&q->blkcg_mutex); if (queue_is_mq(q)) blk_mq_unfreeze_queue(q); diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index b87ed829ab94..53ae0a7fe377 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -485,6 +485,7 @@ struct request_queue { DECLARE_BITMAP (blkcg_pols, BLKCG_MAX_POLS); struct blkcg_gq *root_blkg; struct list_head blkg_list; + struct mutex blkcg_mutex; #endif struct queue_limits limits;