From: Jan Kara <jack@suse.cz>
To: "zhangyi (F)" <yi.zhang@huawei.com>
Cc: linux-ext4@vger.kernel.org, tytso@mit.edu, jack@suse.cz,
adilger.kernel@dilger.ca
Subject: Re: [PATCH v3] ext4: fix potential use after free in system zone via remount with noblock_validity
Date: Wed, 14 Aug 2019 13:14:08 +0200 [thread overview]
Message-ID: <20190814111408.GC26273@quack2.suse.cz> (raw)
In-Reply-To: <1565701547-146508-1-git-send-email-yi.zhang@huawei.com>
On Tue 13-08-19 21:05:47, zhangyi (F) wrote:
> Remount process will release system zone which was allocated before if
> "noblock_validity" is specified. If we mount an ext4 file system to two
> mountpoints with default mount options, and then remount one of them
> with "noblock_validity", it may trigger a use after free problem when
> someone accessing the other one.
>
> # mount /dev/sda foo
> # mount /dev/sda bar
>
> User access mountpoint "foo" | Remount mountpoint "bar"
> |
> ext4_map_blocks() | ext4_remount()
> check_block_validity() | ext4_setup_system_zone()
> ext4_data_block_valid() | ext4_release_system_zone()
> | free system_blks rb nodes
> access system_blks rb nodes |
> trigger use after free |
>
> This problem can also be reproduced by one mountpint, At the same time,
> add_system_zone() can get called during remount as well so there can be
> racing ext4_data_block_valid() reading the rbtree at the same time.
>
> This patch add RCU to protect system zone from releasing or building
> when doing a remount which inverse current "noblock_validity" mount
> option. It assign the rbtree after the whole tree was complete and
> do actual freeing after rcu grace period, avoid any intermediate state.
>
> Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
> ---
> Changes since v2:
> - Remove seqlock, and assign the whole rbtree when finished assembling.
> - Fix the sparse warning.
Thanks for the patch! It looks great to me. Just one nit below and with
that applied feel free to add:
Reviewed-by: Jan Kara <jack@suse.cz>
> int ext4_setup_system_zone(struct super_block *sb)
...
> /* Called when the filesystem is unmounted */
> void ext4_release_system_zone(struct super_block *sb)
Can you perhaps add a comment before ext4_setup_system_zone() and
ext4_release_system_zone() explaining that these two functions are called
under sb->s_umount semaphore protection which also serializes updates of
sb->system_blks pointer? Thanks!
Honza
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
next prev parent reply other threads:[~2019-08-14 11:14 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-13 13:05 [PATCH v3] ext4: fix potential use after free in system zone via remount with noblock_validity zhangyi (F)
2019-08-14 11:14 ` Jan Kara [this message]
2019-08-14 12:28 ` zhangyi (F)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190814111408.GC26273@quack2.suse.cz \
--to=jack@suse.cz \
--cc=adilger.kernel@dilger.ca \
--cc=linux-ext4@vger.kernel.org \
--cc=tytso@mit.edu \
--cc=yi.zhang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).