From: Tejun Heo <tj@kernel.org>
To: Yu Kuai <yukuai1@huaweicloud.com>
Cc: hch@lst.de, josef@toxicpanda.com, axboe@kernel.dk,
cgroups@vger.kernel.org, linux-block@vger.kernel.org,
linux-kernel@vger.kernel.org, yukuai3@huawei.com,
yi.zhang@huawei.com, yangerkun@huawei.com
Subject: Re: [PATCH -next v3 3/3] blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()
Date: Thu, 19 Jan 2023 06:15:55 -1000 [thread overview]
Message-ID: <Y8lsuwtrCYE9jiHb@slm.duckdns.org> (raw)
In-Reply-To: <20230119110350.2287325-4-yukuai1@huaweicloud.com>
On Thu, Jan 19, 2023 at 07:03:50PM +0800, Yu Kuai wrote:
> From: Yu Kuai <yukuai3@huawei.com>
>
> Currently parent pd can be freed before child pd:
>
> t1: remove cgroup C1
> blkcg_destroy_blkgs
> blkg_destroy
> list_del_init(&blkg->q_node)
> // remove blkg from queue list
> percpu_ref_kill(&blkg->refcnt)
> blkg_release
> call_rcu
>
> t2: from t1
> __blkg_release
> blkg_free
> schedule_work
> t4: deactivate policy
> blkcg_deactivate_policy
> pd_free_fn
> // parent of C1 is freed first
> t3: from t2
> blkg_free_workfn
> pd_free_fn
>
> If policy(for example, ioc_timer_fn() from iocost) access parent pd from
> child pd after pd_offline_fn(), then UAF can be triggered.
>
> Fix the problem by delaying 'list_del_init(&blkg->q_node)' from
> blkg_destroy() to blkg_free_workfn(), and using a new disk level mutex to
> synchronize blkg_free_workfn() and blkcg_deactivate_policy().
>
> Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Acked-by: Tejun Heo <tj@kernel.org>
Thanks.
--
tejun
next prev parent reply other threads:[~2023-01-19 16:16 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-19 11:03 [PATCH -next v3 0/3] blk-cgroup: make sure pd_free_fn() is called in order Yu Kuai
2023-01-19 11:03 ` [PATCH -next v3 1/3] blk-cgroup: dropping parent refcount after pd_free_fn() is done Yu Kuai
2023-01-19 16:41 ` Christoph Hellwig
2023-01-19 11:03 ` [PATCH -next v3 2/3] blk-cgroup: support to track if policy is online Yu Kuai
2023-01-19 16:42 ` Christoph Hellwig
2023-01-19 11:03 ` [PATCH -next v3 3/3] blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy() Yu Kuai
2023-01-19 16:15 ` Tejun Heo [this message]
2023-01-19 16:43 ` Christoph Hellwig
2023-01-19 18:54 ` [PATCH -next v3 0/3] blk-cgroup: make sure pd_free_fn() is called in order Jens Axboe
2023-01-29 6:06 ` Yu Kuai
2023-01-29 21:48 ` Jens Axboe
2023-01-29 22:20 ` Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y8lsuwtrCYE9jiHb@slm.duckdns.org \
--to=tj@kernel.org \
--cc=axboe@kernel.dk \
--cc=cgroups@vger.kernel.org \
--cc=hch@lst.de \
--cc=josef@toxicpanda.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=yangerkun@huawei.com \
--cc=yi.zhang@huawei.com \
--cc=yukuai1@huaweicloud.com \
--cc=yukuai3@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®