From: Yu Kuai <yukuai3@huawei.com>
To: <axboe@kernel.dk>, <josef@toxicpanda.com>, <ming.lei@redhat.com>,
<bvanassche@acm.org>
Cc: <linux-block@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<nbd@other.debian.org>, <yukuai3@huawei.com>,
<yi.zhang@huawei.com>
Subject: [PATCH v3 1/5] blk-mq: add a new interface to get request by tag
Date: Tue, 24 Aug 2021 22:12:23 +0800 [thread overview]
Message-ID: <20210824141227.808340-2-yukuai3@huawei.com> (raw)
In-Reply-To: <20210824141227.808340-1-yukuai3@huawei.com>
Ming Lei had fixed the request uaf while iterating tags in
commit bd63141d585b ("blk-mq: clear stale request in tags->rq[] before
freeing one request pool").
However, hctx->tags->rq[] will point to hctx->sched_tags->static_rq[]
in blk_mq_get_driver_tag(), and blk_mq_tag_to_rq() can access such
request in some drivers. Generally it won't be a problem if the
driver can make sure to get drivet tag before calling
blk_mq_tag_to_rq(). However, nbd will do such thing once it receive
a reply message from server, and there isn't any mechanism to
protect that it won't handle the reply message without a corresponding
request message.
Thus add new interface to make sure it won't return a freed request,
and then nbd can check if it had sent the corresponding request message.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
---
block/blk-mq-tag.c | 37 +++++++++++++++++++++++++++++++++++++
block/blk-mq.c | 1 +
block/blk-mq.h | 1 -
include/linux/blk-mq.h | 4 ++++
4 files changed, 42 insertions(+), 1 deletion(-)
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 86f87346232a..ddb159414661 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -652,3 +652,40 @@ u32 blk_mq_unique_tag(struct request *rq)
(rq->tag & BLK_MQ_UNIQUE_TAG_MASK);
}
EXPORT_SYMBOL(blk_mq_unique_tag);
+
+
+/**
+ * blk_mq_get_rq_by_tag - if the request that is represented by the tag is
+ * not idle, increment it's reference and then return it. Otherwise return
+ * NULL.
+ *
+ * @tags: the tags we are looking from
+ * @tag: the tag that represents the request
+ */
+struct request *blk_mq_get_rq_by_tag(struct blk_mq_tags *tags,
+ unsigned int tag)
+{
+ unsigned long flags;
+ struct request *rq;
+
+ /* hold lock to prevent accessing freed request by tag */
+ spin_lock_irqsave(&tags->lock, flags);
+ rq = blk_mq_tag_to_rq(tags, tag);
+ if (!rq)
+ goto out_unlock;
+
+ if (!refcount_inc_not_zero(&rq->ref)) {
+ rq = NULL;
+ goto out_unlock;
+ }
+
+ if (!blk_mq_request_started(rq)) {
+ blk_mq_put_rq_ref(rq);
+ rq = NULL;
+ }
+
+out_unlock:
+ spin_unlock_irqrestore(&tags->lock, flags);
+ return rq;
+}
+EXPORT_SYMBOL(blk_mq_get_rq_by_tag);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 0b3d3e2acb6a..c756a26ed92d 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -916,6 +916,7 @@ void blk_mq_put_rq_ref(struct request *rq)
else if (refcount_dec_and_test(&rq->ref))
__blk_mq_free_request(rq);
}
+EXPORT_SYMBOL_GPL(blk_mq_put_rq_ref);
static bool blk_mq_check_expired(struct blk_mq_hw_ctx *hctx,
struct request *rq, void *priv, bool reserved)
diff --git a/block/blk-mq.h b/block/blk-mq.h
index d08779f77a26..20ef743a3ff6 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -47,7 +47,6 @@ void blk_mq_add_to_requeue_list(struct request *rq, bool at_head,
void blk_mq_flush_busy_ctxs(struct blk_mq_hw_ctx *hctx, struct list_head *list);
struct request *blk_mq_dequeue_from_ctx(struct blk_mq_hw_ctx *hctx,
struct blk_mq_ctx *start);
-void blk_mq_put_rq_ref(struct request *rq);
/*
* Internal helpers for allocating/freeing the request map
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index 22215db36122..ccd8fc4a0bdb 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -641,4 +641,8 @@ blk_qc_t blk_mq_submit_bio(struct bio *bio);
void blk_mq_hctx_set_fq_lock_class(struct blk_mq_hw_ctx *hctx,
struct lock_class_key *key);
+struct request *blk_mq_get_rq_by_tag(struct blk_mq_tags *tags,
+ unsigned int tag);
+void blk_mq_put_rq_ref(struct request *rq);
+
#endif
--
2.31.1
next prev parent reply other threads:[~2021-08-24 14:02 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-24 14:12 [PATCH v3 0/5] fix request uaf in nbd_read_stat() Yu Kuai
2021-08-24 14:12 ` Yu Kuai [this message]
2021-08-24 14:12 ` [PATCH v3 2/5] nbd: convert to use blk_mq_get_rq_by_tag() Yu Kuai
2021-08-24 14:12 ` [PATCH v3 3/5] nbd: don't handle response without a corresponding request message Yu Kuai
2021-08-24 14:12 ` [PATCH v3 4/5] nbd: make sure request completion won't concurrent Yu Kuai
2021-08-24 14:12 ` [PATCH v3 5/5] nbd: don't start request if nbd_queue_rq() failed Yu Kuai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210824141227.808340-2-yukuai3@huawei.com \
--to=yukuai3@huawei.com \
--cc=axboe@kernel.dk \
--cc=bvanassche@acm.org \
--cc=josef@toxicpanda.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ming.lei@redhat.com \
--cc=nbd@other.debian.org \
--cc=yi.zhang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).