Messages in this thread | | | Date | Wed, 14 Dec 2022 09:54:35 -0700 | Subject | Re: [PATCH-block v3 1/2] bdi, blk-cgroup: Fix potential UAF of blkcg | From | Jens Axboe <> |
| |
On 12/13/22 12:53 PM, Waiman Long wrote: > > On 12/13/22 14:29, Tejun Heo wrote: >> On Tue, Dec 13, 2022 at 01:44:45PM -0500, Waiman Long wrote: >>> Commit 59b57717fff8 ("blkcg: delay blkg destruction until after >>> writeback has finished") delayed call to blkcg_destroy_blkgs() to >>> cgwb_release_workfn(). However, it is done after a css_put() of blkcg >>> which may be the final put that causes the blkcg to be freed as RCU >>> read lock isn't held. >>> >>> Another place where blkcg_destroy_blkgs() can be called indirectly via >>> blkcg_unpin_online() is from the offline_css() function called from >>> css_killed_work_fn(). Over there, the potentially final css_put() call >>> is issued after offline_css(). >>> >>> By adding a css_tryget() into blkcg_destroy_blkgs() and warning its >>> failure, the following stack trace was produced in a test system on >>> bootup. >> This doesn't agree with the code anymore. Otherwise >> >> Acked-by: Tejun Heo <tj@kernel.org> > > Sorry, I overlooked the commit log in my update. I will update it if I need another version, or Jens can make the following edit: > > css_tryget() -> percpu_ref_is_zero().
Since the other one also needs an edit, would be great if you could just send out a v4.
-- Jens Axboe
| |