| Message ID | 20230118123152.1926314-4-yukuai1@huaweicloud.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | blk-cgroup: make sure pd_free_fn() is called in order | expand |
Hello, On Wed, Jan 18, 2023 at 08:31:52PM +0800, Yu Kuai wrote: > From: Yu Kuai <yukuai3@huawei.com> > > Currently parent pd can be freed before child pd: > > t1: remove cgroup C1 > blkcg_destroy_blkgs > blkg_destroy > list_del_init(&blkg->q_node) > // remove blkg from queue list > percpu_ref_kill(&blkg->refcnt) > blkg_release > call_rcu > > t2: from t1 > __blkg_release > blkg_free > schedule_work > t4: deactivate policy > blkcg_deactivate_policy > pd_free_fn > // parent of C1 is freed first > t3: from t2 > blkg_free_workfn > pd_free_fn > > If policy(for example, ioc_timer_fn() from iocost) access parent pd from > child pd after pd_offline_fn(), then UAF can be triggered. > > Fix the problem by delaying 'list_del_init(&blkg->q_node)' from > blkg_destroy() to blkg_free_workfn(), and use a new disk level mutex to ^ using > protect blkg_free_workfn() and blkcg_deactivate_policy). ^ ^ synchronize? () > @@ -118,16 +118,26 @@ static void blkg_free_workfn(struct work_struct *work) > { > struct blkcg_gq *blkg = container_of(work, struct blkcg_gq, > free_work); > + struct request_queue *q = blkg->q; > int i; > > + if (q) > + mutex_lock(&q->blkcg_mutex); A comment explaining what the above is synchronizing would be useful. > + > for (i = 0; i < BLKCG_MAX_POLS; i++) > if (blkg->pd[i]) > blkcg_policy[i]->pd_free_fn(blkg->pd[i]); > > if (blkg->parent) > blkg_put(blkg->parent); > - if (blkg->q) > - blk_put_queue(blkg->q); > + > + if (q) { > + if (!list_empty(&blkg->q_node)) We can drop the above if. > + list_del_init(&blkg->q_node); > + mutex_unlock(&q->blkcg_mutex); > + blk_put_queue(q); > + } > + > free_percpu(blkg->iostat_cpu); > percpu_ref_exit(&blkg->refcnt); > kfree(blkg); > @@ -462,9 +472,14 @@ static void blkg_destroy(struct blkcg_gq *blkg) > lockdep_assert_held(&blkg->q->queue_lock); > lockdep_assert_held(&blkcg->lock); > > - /* Something wrong if we are trying to remove same group twice */ > - WARN_ON_ONCE(list_empty(&blkg->q_node)); > - WARN_ON_ONCE(hlist_unhashed(&blkg->blkcg_node)); > + /* > + * blkg is removed from queue list in blkg_free_workfn(), hence this > + * function can be called from blkcg_destroy_blkgs() first, and then > + * before blkg_free_workfn(), this function can be called again in > + * blkg_destroy_all(). How about? * blkg stays on the queue list until blkg_free_workfn(), hence this * function can be called from blkcg_destroy_blkgs() first and again * from blkg_destroy_all() before blkg_free_workfn(). > + */ > + if (hlist_unhashed(&blkg->blkcg_node)) > + return; > > for (i = 0; i < BLKCG_MAX_POLS; i++) { > struct blkcg_policy *pol = blkcg_policy[i]; > @@ -478,8 +493,11 @@ static void blkg_destroy(struct blkcg_gq *blkg) > > blkg->online = false; > > + /* > + * Delay deleting list blkg->q_node to blkg_free_workfn() to synchronize > + * pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy(). > + */ So, it'd be better to add a more comprehensive comment in blkg_free_workfn() explaining why we need this synchronization and how it works and then point to it from here. Other than comments, it looks great to me. Thanks a lot for your patience and seeing it through.
Hi, 在 2023/01/19 1:05, Tejun Heo 写道: > Hello, > > On Wed, Jan 18, 2023 at 08:31:52PM +0800, Yu Kuai wrote: >> From: Yu Kuai <yukuai3@huawei.com> >> >> Currently parent pd can be freed before child pd: >> >> t1: remove cgroup C1 >> blkcg_destroy_blkgs >> blkg_destroy >> list_del_init(&blkg->q_node) >> // remove blkg from queue list >> percpu_ref_kill(&blkg->refcnt) >> blkg_release >> call_rcu >> >> t2: from t1 >> __blkg_release >> blkg_free >> schedule_work >> t4: deactivate policy >> blkcg_deactivate_policy >> pd_free_fn >> // parent of C1 is freed first >> t3: from t2 >> blkg_free_workfn >> pd_free_fn >> >> If policy(for example, ioc_timer_fn() from iocost) access parent pd from >> child pd after pd_offline_fn(), then UAF can be triggered. >> >> Fix the problem by delaying 'list_del_init(&blkg->q_node)' from >> blkg_destroy() to blkg_free_workfn(), and use a new disk level mutex to > ^ > using > >> protect blkg_free_workfn() and blkcg_deactivate_policy). > ^ ^ > synchronize? () > >> @@ -118,16 +118,26 @@ static void blkg_free_workfn(struct work_struct *work) >> { >> struct blkcg_gq *blkg = container_of(work, struct blkcg_gq, >> free_work); >> + struct request_queue *q = blkg->q; >> int i; >> >> + if (q) >> + mutex_lock(&q->blkcg_mutex); > > A comment explaining what the above is synchronizing would be useful. > >> + >> for (i = 0; i < BLKCG_MAX_POLS; i++) >> if (blkg->pd[i]) >> blkcg_policy[i]->pd_free_fn(blkg->pd[i]); >> >> if (blkg->parent) >> blkg_put(blkg->parent); >> - if (blkg->q) >> - blk_put_queue(blkg->q); >> + >> + if (q) { >> + if (!list_empty(&blkg->q_node)) > > We can drop the above if. > >> + list_del_init(&blkg->q_node); >> + mutex_unlock(&q->blkcg_mutex); >> + blk_put_queue(q); >> + } >> + >> free_percpu(blkg->iostat_cpu); >> percpu_ref_exit(&blkg->refcnt); >> kfree(blkg); >> @@ -462,9 +472,14 @@ static void blkg_destroy(struct blkcg_gq *blkg) >> lockdep_assert_held(&blkg->q->queue_lock); >> lockdep_assert_held(&blkcg->lock); >> >> - /* Something wrong if we are trying to remove same group twice */ >> - WARN_ON_ONCE(list_empty(&blkg->q_node)); >> - WARN_ON_ONCE(hlist_unhashed(&blkg->blkcg_node)); >> + /* >> + * blkg is removed from queue list in blkg_free_workfn(), hence this >> + * function can be called from blkcg_destroy_blkgs() first, and then >> + * before blkg_free_workfn(), this function can be called again in >> + * blkg_destroy_all(). > > How about? > > * blkg stays on the queue list until blkg_free_workfn(), hence this > * function can be called from blkcg_destroy_blkgs() first and again > * from blkg_destroy_all() before blkg_free_workfn(). > >> + */ >> + if (hlist_unhashed(&blkg->blkcg_node)) >> + return; >> >> for (i = 0; i < BLKCG_MAX_POLS; i++) { >> struct blkcg_policy *pol = blkcg_policy[i]; >> @@ -478,8 +493,11 @@ static void blkg_destroy(struct blkcg_gq *blkg) >> >> blkg->online = false; >> >> + /* >> + * Delay deleting list blkg->q_node to blkg_free_workfn() to synchronize >> + * pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy(). >> + */ > > So, it'd be better to add a more comprehensive comment in blkg_free_workfn() > explaining why we need this synchronization and how it works and then point > to it from here. > > Other than comments, it looks great to me. Thanks a lot for your patience > and seeing it through. Thanks for the suggestions, I'll send a new patch based on your suggestions. Kuai >
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 75f3c4460715..4098e8030e01 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -118,16 +118,26 @@ static void blkg_free_workfn(struct work_struct *work) { struct blkcg_gq *blkg = container_of(work, struct blkcg_gq, free_work); + struct request_queue *q = blkg->q; int i; + if (q) + mutex_lock(&q->blkcg_mutex); + for (i = 0; i < BLKCG_MAX_POLS; i++) if (blkg->pd[i]) blkcg_policy[i]->pd_free_fn(blkg->pd[i]); if (blkg->parent) blkg_put(blkg->parent); - if (blkg->q) - blk_put_queue(blkg->q); + + if (q) { + if (!list_empty(&blkg->q_node)) + list_del_init(&blkg->q_node); + mutex_unlock(&q->blkcg_mutex); + blk_put_queue(q); + } + free_percpu(blkg->iostat_cpu); percpu_ref_exit(&blkg->refcnt); kfree(blkg); @@ -462,9 +472,14 @@ static void blkg_destroy(struct blkcg_gq *blkg) lockdep_assert_held(&blkg->q->queue_lock); lockdep_assert_held(&blkcg->lock); - /* Something wrong if we are trying to remove same group twice */ - WARN_ON_ONCE(list_empty(&blkg->q_node)); - WARN_ON_ONCE(hlist_unhashed(&blkg->blkcg_node)); + /* + * blkg is removed from queue list in blkg_free_workfn(), hence this + * function can be called from blkcg_destroy_blkgs() first, and then + * before blkg_free_workfn(), this function can be called again in + * blkg_destroy_all(). + */ + if (hlist_unhashed(&blkg->blkcg_node)) + return; for (i = 0; i < BLKCG_MAX_POLS; i++) { struct blkcg_policy *pol = blkcg_policy[i]; @@ -478,8 +493,11 @@ static void blkg_destroy(struct blkcg_gq *blkg) blkg->online = false; + /* + * Delay deleting list blkg->q_node to blkg_free_workfn() to synchronize + * pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy(). + */ radix_tree_delete(&blkcg->blkg_tree, blkg->q->id); - list_del_init(&blkg->q_node); hlist_del_init_rcu(&blkg->blkcg_node); /* @@ -1280,6 +1298,7 @@ int blkcg_init_disk(struct gendisk *disk) int ret; INIT_LIST_HEAD(&q->blkg_list); + mutex_init(&q->blkcg_mutex); new_blkg = blkg_alloc(&blkcg_root, disk, GFP_KERNEL); if (!new_blkg) @@ -1520,6 +1539,7 @@ void blkcg_deactivate_policy(struct request_queue *q, if (queue_is_mq(q)) blk_mq_freeze_queue(q); + mutex_lock(&q->blkcg_mutex); spin_lock_irq(&q->queue_lock); __clear_bit(pol->plid, q->blkcg_pols); @@ -1538,6 +1558,7 @@ void blkcg_deactivate_policy(struct request_queue *q, } spin_unlock_irq(&q->queue_lock); + mutex_unlock(&q->blkcg_mutex); if (queue_is_mq(q)) blk_mq_unfreeze_queue(q); diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index b87ed829ab94..53ae0a7fe377 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -485,6 +485,7 @@ struct request_queue { DECLARE_BITMAP (blkcg_pols, BLKCG_MAX_POLS); struct blkcg_gq *root_blkg; struct list_head blkg_list; + struct mutex blkcg_mutex; #endif struct queue_limits limits;