From patchwork Mon Jan 30 01:41:36 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu Kuai X-Patchwork-Id: 50084 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp1956264wrn; Sun, 29 Jan 2023 17:30:29 -0800 (PST) X-Google-Smtp-Source: AK7set8J0PWMHGCJ8X843lTWSWji6wxBJ7MEKPt26VjQeEEQgKJ2ildkui8BzwdZl3OG/C5lRvaV X-Received: by 2002:a05:6a20:6982:b0:bc:d18d:b58b with SMTP id t2-20020a056a20698200b000bcd18db58bmr4820622pzk.13.1675042229232; Sun, 29 Jan 2023 17:30:29 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1675042229; cv=none; d=google.com; s=arc-20160816; b=QVwyPbhM8U25wKjenKxoqZ8H/H9K2b6+Ig27ayH4WhoGIql5kj2N7PhD3drWKvJNWS RDktNmdgdxJVCUwVIQDfBvzB4M4CR4UxIK+A622V8glFVo81Xqa8FrHMzek8Sm0D+Qsa 6XkuA2xfcmCY+7rRHIn+h8pvxyqpjPfEb3+/poypnxMnL0RlZLU50p7qEgRx+EG3Ob16 ZiAhT+klSHYtZLww53dXL4VOsSrQA9lb+/Y8WSJ/1HDpfhRECkkZyrpwYDF9mFpWMD07 tc1zd0cKer11+Xa8rsDKLN1BI3PsslKUjOVAT2CQ0S3tGGVg/WDcEMINPUE0tOXoX1dy IksQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=26kL3WtSijmPey3/uY9ufzM+OTCV9tk5KVNeBe0IpOc=; b=v1kbY9tfOhnijIzLZ943A+JUmRgGxsxm5iOobtazDHmLRo5xg4IYNDp+oeDizUKIg+ D6RrSdj1M/LMMhf0z3J7vpZcN6ToWdODsvpAgPvLuANISDo+KL80ds9O5d3xnhEBl3ij Q63P0Yhb6cfHoniWu83BSnyqgLom2JE4dLLHKV4J+Y+SfJWFRCfbp/y3beF9tCySGXij 5zKAdgX6CjcvJ5pASTCkUrvrBvN2nZcDCNlemluwuQpQ1p7MsPi4lg6rReXXzaKvtdZo 3f5gNp1QiOXa+Iilr/zkt1tOQIE6yXFcYbhgBe5fHabJcjd7s/pS6mrw+9d+8m/jQc2P rHZA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id x22-20020aa79576000000b0058bb299c48bsi11253099pfq.245.2023.01.29.17.30.11; Sun, 29 Jan 2023 17:30:29 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235268AbjA3BRl (ORCPT + 99 others); Sun, 29 Jan 2023 20:17:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51386 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232549AbjA3BRk (ORCPT ); Sun, 29 Jan 2023 20:17:40 -0500 Received: from dggsgout11.his.huawei.com (unknown [45.249.212.51]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1947013D71; Sun, 29 Jan 2023 17:17:39 -0800 (PST) Received: from mail02.huawei.com (unknown [172.30.67.143]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTP id 4P4qzf14lHz4f3kp2; Mon, 30 Jan 2023 09:17:34 +0800 (CST) Received: from huaweicloud.com (unknown [10.175.127.227]) by APP3 (Coremail) with SMTP id _Ch0CgCHgR+uGtdjhGmuCQ--.6383S4; Mon, 30 Jan 2023 09:17:36 +0800 (CST) From: Yu Kuai To: tj@kernel.org, josef@toxicpanda.com, axboe@kernel.dk, paolo.valente@linaro.org, yukuai3@huawei.com, jack@suse.cz Cc: cgroups@vger.kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, yukuai1@huaweicloud.com, yi.zhang@huawei.com, yangerkun@huawei.com Subject: [PATCH v2 block-6.2] block, bfq: fix uaf for bfqq in bic_set_bfqq() Date: Mon, 30 Jan 2023 09:41:36 +0800 Message-Id: <20230130014136.591038-1-yukuai1@huaweicloud.com> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 X-CM-TRANSID: _Ch0CgCHgR+uGtdjhGmuCQ--.6383S4 X-Coremail-Antispam: 1UD129KBjvJXoW7Kw1xCF4rCr17tF1fJF4fKrg_yoW8Ary5pw nFga17WF97XFs5XF4UJ3WkXF18GFs5CryDK342q3y2vFy7Aw12yan0v3y0vFZ2qrySkay3 Zw1j93ykAr1jgrDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvF14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26F1j6w1UM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gc CE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx0E 2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJV W8JwACjcxG0xvY0x0EwIxGrwACjI8F5VA0II8E6IAqYI8I648v4I1lFIxGxcIEc7CjxVA2 Y2ka0xkIwI1l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4 xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r1q6r43 MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I 0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWrJr0_WFyUJwCI42IY6I8E87Iv67AK xVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuYvj fUoOJ5UUUUU X-CM-SenderInfo: 51xn3trlr6x35dzhxuhorxvhhfrp/ X-CFilter-Loop: Reflected X-Spam-Status: No, score=-0.9 required=5.0 tests=BAYES_00,KHOP_HELO_FCRDNS, MAY_BE_FORGED,SPF_HELO_NONE,SPF_NONE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1754899148089732929?= X-GMAIL-MSGID: =?utf-8?q?1756409080073557931?= From: Yu Kuai After commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'"), bic->bfqq will be accessed in bic_set_bfqq(), however, in some context bic->bfqq will be freed, and bic_set_bfqq() is called with the freed bic->bfqq. Fix the problem by always freeing bfqq after bic_set_bfqq(). Fixes: 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") Reported-and-tested-by: Shinichiro Kawasaki Signed-off-by: Yu Kuai Reviewed-by: Jan Kara --- block/bfq-cgroup.c | 2 +- block/bfq-iosched.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c index 7d9b15f0dbd5..0fbde0fc0628 100644 --- a/block/bfq-cgroup.c +++ b/block/bfq-cgroup.c @@ -769,8 +769,8 @@ static void __bfq_bic_change_cgroup(struct bfq_data *bfqd, * request from the old cgroup. */ bfq_put_cooperator(sync_bfqq); - bfq_release_process_ref(bfqd, sync_bfqq); bic_set_bfqq(bic, NULL, true); + bfq_release_process_ref(bfqd, sync_bfqq); } } } diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index ccf2204477a5..380e9bda2e57 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -5425,9 +5425,11 @@ static void bfq_check_ioprio_change(struct bfq_io_cq *bic, struct bio *bio) bfqq = bic_to_bfqq(bic, false); if (bfqq) { - bfq_release_process_ref(bfqd, bfqq); + struct bfq_queue *old_bfqq = bfqq; + bfqq = bfq_get_queue(bfqd, bio, false, bic, true); bic_set_bfqq(bic, bfqq, false); + bfq_release_process_ref(bfqd, old_bfqq); } bfqq = bic_to_bfqq(bic, true);