Messages in this thread | | | Subject | Re: [PATCH BUGFIX V2 1/1] block, bfq: deschedule empty bfq_queues not referred by any process | From | Holger Hoffstätte <> | Date | Fri, 15 Nov 2019 19:32:50 +0100 |
| |
On 11/14/19 10:33 AM, Paolo Valente wrote: > Since commit 3726112ec731 ("block, bfq: re-schedule empty queues if > they deserve I/O plugging"), to prevent the service guarantees of a > bfq_queue from being violated, the bfq_queue may be left busy, i.e., > scheduled for service, even if empty (see comments in > __bfq_bfqq_expire() for details). But, if no process will send > requests to the bfq_queue any longer, then there is no point in > keeping the bfq_queue scheduled for service. > > In addition, keeping the bfq_queue scheduled for service, but with no > process reference any longer, may cause the bfq_queue to be freed when > descheduled from service. But this is assumed to never happen, and > causes a UAF if it happens. This, in turn, caused crashes [1, 2]. > > This commit fixes this issue by descheduling an empty bfq_queue when > it remains with not process reference. > > [1] https://bugzilla.redhat.com/show_bug.cgi?id=1767539 > [2] https://bugzilla.kernel.org/show_bug.cgi?id=205447 > > Fixes: 3726112ec731 ("block, bfq: re-schedule empty queues if they deserve I/O plugging") > Reported-by: Chris Evich <cevich@redhat.com> > Reported-by: Patrick Dung <patdung100@gmail.com> > Reported-by: Thorsten Schubert <tschubert@bafh.org> > Tested-by: Thorsten Schubert <tschubert@bafh.org> > Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name> > Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
Jens,
can you please also tag this for stable-5.3 before the next push? The original problem was found on 5.3 after all, and hoping for the stable-bot to pick it up automagically is a bit unreliable.
Thanks, Holger
| |