Messages in this thread | | | Date | Wed, 14 Dec 2022 11:55:24 -0500 | Subject | Re: [PATCH-block v3 1/2] bdi, blk-cgroup: Fix potential UAF of blkcg | From | Waiman Long <> |
| |
On 12/14/22 11:54, Jens Axboe wrote: > On 12/13/22 12:53 PM, Waiman Long wrote: >> On 12/13/22 14:29, Tejun Heo wrote: >>> On Tue, Dec 13, 2022 at 01:44:45PM -0500, Waiman Long wrote: >>>> Commit 59b57717fff8 ("blkcg: delay blkg destruction until after >>>> writeback has finished") delayed call to blkcg_destroy_blkgs() to >>>> cgwb_release_workfn(). However, it is done after a css_put() of blkcg >>>> which may be the final put that causes the blkcg to be freed as RCU >>>> read lock isn't held. >>>> >>>> Another place where blkcg_destroy_blkgs() can be called indirectly via >>>> blkcg_unpin_online() is from the offline_css() function called from >>>> css_killed_work_fn(). Over there, the potentially final css_put() call >>>> is issued after offline_css(). >>>> >>>> By adding a css_tryget() into blkcg_destroy_blkgs() and warning its >>>> failure, the following stack trace was produced in a test system on >>>> bootup. >>> This doesn't agree with the code anymore. Otherwise >>> >>> Acked-by: Tejun Heo <tj@kernel.org> >> Sorry, I overlooked the commit log in my update. I will update it if I need another version, or Jens can make the following edit: >> >> css_tryget() -> percpu_ref_is_zero(). > Since the other one also needs an edit, would be great if you could > just send out a v4. > Sure, will do that.
Cheers, Longman
| |