From patchwork Wed Apr 10 08:38:33 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Valente X-Patchwork-Id: 162008 Delivered-To: patch@linaro.org Received: by 2002:a02:c6d8:0:0:0:0:0 with SMTP id r24csp5934359jan; Wed, 10 Apr 2019 01:38:48 -0700 (PDT) X-Google-Smtp-Source: APXvYqyEnfo7c+vJowlsI6xL8qroIbrfmpFzHWX/Jh0WmJQ2biMoae10jDgADPBp1PX/Av9z16pO X-Received: by 2002:aa7:8b08:: with SMTP id f8mr41207373pfd.146.1554885528673; Wed, 10 Apr 2019 01:38:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1554885528; cv=none; d=google.com; s=arc-20160816; b=SGkOEKXl7ZqvVp7327BOe3zCr9ZSPMYjZBOpUy4i9lpz3luZRyjugmpULzFXqwZjra AUi191r5b21mo45MOMkmc+SsFF2mRD38sWnKckTtWTvFViJUBmdjBMtczLuRHk5vjFNz mCvv4q7PH1xBPV2rkvgzhhEVLiNVESxXkC68AXBVAM4ro23zBy92G/+AdTBBpBf08fN1 1af0XgZYJd2sOFOjgXv+fx9uQUKUO2cajeDnfYve6BWzT65zlMQEtD5DwbSP+9eKdzWH 6TzTvmQJacpB6K8CRpqGYql7qzcRxhBree3jsguenJUq1oWqq6xo0ar7CKa/SJbHYDbs FOkg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=BWd78AzbhQzEPASngzTuqEKi4n3YA2PuHkAQ/kL082I=; b=u9RWBL3XP7teJ1XEUD1b4e6aFiEZVUXkm34w2uqVEpFbs2cuQYAZGw1le9yWO1G8n0 cTyZodS4u873bdZj1vmeGSMHyIO2GtG27qmrpstVH3wxSoNtPIccCmBT6fFCPcuY0Dv5 4X0rrdVGmUW08vJep7emDJ2LKjH2kMzIVqrON0MKHFjyqlkNRfGRm90QSYf9O773+gKx dy5HYACL/8X/1h3Qc1ldzBrBhH5vgQTJP3r/mKFabJoZUb15REXoGAFAWg9JnD5o880o wwS8q0pSkL1KM6+eeQWxmRqLukn1hd8tBFxNwftUKQnegdeXEkd/ZvHllzVHlhr2+NV7 MVXg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=Yb84ElHi; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id t13si13102973pgp.569.2019.04.10.01.38.48; Wed, 10 Apr 2019 01:38:48 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=Yb84ElHi; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729673AbfDJIiq (ORCPT + 31 others); Wed, 10 Apr 2019 04:38:46 -0400 Received: from mail-wr1-f67.google.com ([209.85.221.67]:33106 "EHLO mail-wr1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729660AbfDJIip (ORCPT ); Wed, 10 Apr 2019 04:38:45 -0400 Received: by mail-wr1-f67.google.com with SMTP id q1so1901903wrp.0 for ; Wed, 10 Apr 2019 01:38:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=BWd78AzbhQzEPASngzTuqEKi4n3YA2PuHkAQ/kL082I=; b=Yb84ElHiAi3ngZek3tuF3xo9EzqvPtaKktmLhWE+2RswltKfl0bJVRpRAjD3SHs8JN s/vaYMkFYP8CS7yMcR8TRLOxFRWD80DZbLSYtSPaWrCdkfZTGXWeuXG9I7vXJGxlWo/G iqymBJDbHlejFcEDTMOcJpYgh+dodSYGEk/R9iZhpX/P+YshbxcogGiIk/ARodvCPqUc zNG8Ser0pYit3dJLYpI/9tm5HYx5LZBDksBE7V5hne3HWRXcin97r1NUsORxYvp7uvL6 MtDvdEr4fY5yAAmbovi5m9XN8JMMY+beFmkKttBpT0fX8SU5n+mQQwo0d7z/UqJPOJZ/ Fkbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=BWd78AzbhQzEPASngzTuqEKi4n3YA2PuHkAQ/kL082I=; b=lh06ftDrPgGEw8UePTvkD3YeqCh0fG9gzMLjrJFh6uFoQqjfwmG8qX/fKar4Zldsz+ fDoPV+1wkdoL2DXT7+IqGhWjrD38LHtuLSp2Ob7GDWCuX0itX9HDupxgYvzzH+SUZdtd m2vuxe8mwj1wkiZroTmIU7QLtuIpy1YkZgmdq1yfiG6dmql/PvrKQsF7dwfKaUiTiW1w eM6UM3qJpP4dphzbZJwfMBEpsIqzRbuiiU8hwWQIFP52C8KddStNUu0BeT03ACEl4uMC lLVFXyLy0o0xJyDizK5z9yfPPpGEd3gnMG0rGsh/u09z0zdP5IoQr8OPp2xdSkGGiw+5 VGtw== X-Gm-Message-State: APjAAAV0V1fWjcLd9l2BI5FYiyA3UPfLBASICLJ6MxtSs6j8hqiSy2Iy vPGI+yhlvEjlg8pEzl90az9i5A== X-Received: by 2002:a5d:6706:: with SMTP id o6mr27983111wru.36.1554885523267; Wed, 10 Apr 2019 01:38:43 -0700 (PDT) Received: from wifi-122_dhcprange-158.wifi.unimo.it ([155.185.122.158]) by smtp.gmail.com with ESMTPSA id s10sm1859936wmh.0.2019.04.10.01.38.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 10 Apr 2019 01:38:42 -0700 (PDT) From: Paolo Valente To: Jens Axboe Cc: linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, ulf.hansson@linaro.org, linus.walleij@linaro.org, broonie@kernel.org, bfq-iosched@googlegroups.com, oleksandr@natalenko.name, Paolo Valente , Dmitrii Tcvetkov , Douglas Anderson Subject: [PATCH BUGFIX V2] block, bfq: fix use after free in bfq_bfqq_expire Date: Wed, 10 Apr 2019 10:38:33 +0200 Message-Id: <20190410083833.14462-1-paolo.valente@linaro.org> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The function bfq_bfqq_expire() invokes the function __bfq_bfqq_expire(), and the latter may free the in-service bfq-queue. If this happens, then no other instruction of bfq_bfqq_expire() must be executed, or a use-after-free will occur. Basing on the assumption that __bfq_bfqq_expire() invokes bfq_put_queue() on the in-service bfq-queue exactly once, the queue is assumed to be freed if its refcounter is equal to one right before invoking __bfq_bfqq_expire(). But, since commit 9dee8b3b057e ("block, bfq: fix queue removal from weights tree") this assumption is false. __bfq_bfqq_expire() may also invoke bfq_weights_tree_remove() and, since commit 9dee8b3b057e ("block, bfq: fix queue removal from weights tree"), also the latter function may invoke bfq_put_queue(). So __bfq_bfqq_expire() may invoke bfq_put_queue() twice, and this is the actual case where the in-service queue may happen to be freed. To address this issue, this commit moves the check on the refcounter of the queue right around the last bfq_put_queue() that may be invoked on the queue. Fixes: 9dee8b3b057e ("block, bfq: fix queue removal from weights tree") Reported-by: Dmitrii Tcvetkov Reported-by: Douglas Anderson Tested-by: Dmitrii Tcvetkov Tested-by: Douglas Anderson Signed-off-by: Paolo Valente --- block/bfq-iosched.c | 15 +++++++-------- block/bfq-iosched.h | 2 +- block/bfq-wf2q.c | 17 +++++++++++++++-- 3 files changed, 23 insertions(+), 11 deletions(-) -- 2.20.1 diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index fac188dd78fa..dfb8cb0af13a 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -2822,7 +2822,7 @@ static void bfq_dispatch_remove(struct request_queue *q, struct request *rq) bfq_remove_request(q, rq); } -static void __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq) +static bool __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq) { /* * If this bfqq is shared between multiple processes, check @@ -2855,9 +2855,11 @@ static void __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq) /* * All in-service entities must have been properly deactivated * or requeued before executing the next function, which - * resets all in-service entites as no more in service. + * resets all in-service entities as no more in service. This + * may cause bfqq to be freed. If this happens, the next + * function returns true. */ - __bfq_bfqd_reset_in_service(bfqd); + return __bfq_bfqd_reset_in_service(bfqd); } /** @@ -3262,7 +3264,6 @@ void bfq_bfqq_expire(struct bfq_data *bfqd, bool slow; unsigned long delta = 0; struct bfq_entity *entity = &bfqq->entity; - int ref; /* * Check whether the process is slow (see bfq_bfqq_is_slow). @@ -3347,10 +3348,8 @@ void bfq_bfqq_expire(struct bfq_data *bfqd, * reason. */ __bfq_bfqq_recalc_budget(bfqd, bfqq, reason); - ref = bfqq->ref; - __bfq_bfqq_expire(bfqd, bfqq); - - if (ref == 1) /* bfqq is gone, no more actions on it */ + if (__bfq_bfqq_expire(bfqd, bfqq)) + /* bfqq is gone, no more actions on it */ return; bfqq->injected_service = 0; diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h index 062e1c4787f4..86394e503ca9 100644 --- a/block/bfq-iosched.h +++ b/block/bfq-iosched.h @@ -995,7 +995,7 @@ bool __bfq_deactivate_entity(struct bfq_entity *entity, bool ins_into_idle_tree); bool next_queue_may_preempt(struct bfq_data *bfqd); struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd); -void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd); +bool __bfq_bfqd_reset_in_service(struct bfq_data *bfqd); void bfq_deactivate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq, bool ins_into_idle_tree, bool expiration); void bfq_activate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq); diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c index a11bef75483d..ae4d000ac0af 100644 --- a/block/bfq-wf2q.c +++ b/block/bfq-wf2q.c @@ -1605,7 +1605,8 @@ struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd) return bfqq; } -void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd) +/* returns true if the in-service queue gets freed */ +bool __bfq_bfqd_reset_in_service(struct bfq_data *bfqd) { struct bfq_queue *in_serv_bfqq = bfqd->in_service_queue; struct bfq_entity *in_serv_entity = &in_serv_bfqq->entity; @@ -1629,8 +1630,20 @@ void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd) * service tree either, then release the service reference to * the queue it represents (taken with bfq_get_entity). */ - if (!in_serv_entity->on_st) + if (!in_serv_entity->on_st) { + /* + * If no process is referencing in_serv_bfqq any + * longer, then the service reference may be the only + * reference to the queue. If this is the case, then + * bfqq gets freed here. + */ + int ref = in_serv_bfqq->ref; bfq_put_queue(in_serv_bfqq); + if (ref == 1) + return true; + } + + return false; } void bfq_deactivate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,