* fix struct file use after free in the AIO read path @ 2016-09-30 8:46 Christoph Hellwig 2016-09-30 8:46 ` [PATCH 1/2] xfs: update atime before I/O in xfs_file_dio_aio_read Christoph Hellwig 2016-09-30 8:46 ` [PATCH 2/2] fs: update atime before I/O in generic_file_read_iter Christoph Hellwig 0 siblings, 2 replies; 6+ messages in thread From: Christoph Hellwig @ 2016-09-30 8:46 UTC (permalink / raw) To: linux-xfs; +Cc: linux-fsdevel We can't use struct file after we have submitted I/O because aio_complete might have done the final fput on it already. Fix this by updating the atime before performing I/O. ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2] xfs: update atime before I/O in xfs_file_dio_aio_read 2016-09-30 8:46 fix struct file use after free in the AIO read path Christoph Hellwig @ 2016-09-30 8:46 ` Christoph Hellwig 2016-09-30 8:46 ` [PATCH 2/2] fs: update atime before I/O in generic_file_read_iter Christoph Hellwig 1 sibling, 0 replies; 6+ messages in thread From: Christoph Hellwig @ 2016-09-30 8:46 UTC (permalink / raw) To: linux-xfs; +Cc: linux-fsdevel After the call to __blkdev_direct_IO the final reference to the file might have been dropped by aio_complete already, and the call to file_accessed might cause a use after free. Instead update the access time before the I/O, similar to how we update the time stamps before writes. Signed-off-by: Christoph Hellwig <hch@lst.de> Reported-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Tested-by: Darrick J. Wong <darrick.wong@oracle.com> --- fs/xfs/xfs_file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c index ef01bd3..301fb3c 100644 --- a/fs/xfs/xfs_file.c +++ b/fs/xfs/xfs_file.c @@ -270,6 +270,8 @@ xfs_file_dio_aio_read( return -EINVAL; } + file_accessed(iocb->ki_filp); + /* * Locking is a bit tricky here. If we take an exclusive lock for direct * IO, we effectively serialise all new concurrent read IO to this file @@ -324,7 +326,6 @@ xfs_file_dio_aio_read( } xfs_rw_iunlock(ip, XFS_IOLOCK_SHARED); - file_accessed(iocb->ki_filp); return ret; } -- 2.1.4 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] fs: update atime before I/O in generic_file_read_iter 2016-09-30 8:46 fix struct file use after free in the AIO read path Christoph Hellwig 2016-09-30 8:46 ` [PATCH 1/2] xfs: update atime before I/O in xfs_file_dio_aio_read Christoph Hellwig @ 2016-09-30 8:46 ` Christoph Hellwig 2016-10-04 8:13 ` Jan Kara 1 sibling, 1 reply; 6+ messages in thread From: Christoph Hellwig @ 2016-09-30 8:46 UTC (permalink / raw) To: linux-xfs; +Cc: linux-fsdevel After the call to ->direct_IO the final reference to the file might have been dropped by aio_complete already, and the call to file_accessed might cause a use after free. Instead update the access time before the I/O, similar to how we update the time stamps before writes. Signed-off-by: Christoph Hellwig <hch@lst.de> --- mm/filemap.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/mm/filemap.c b/mm/filemap.c index 8a287df..2f1175e 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -1910,16 +1910,18 @@ generic_file_read_iter(struct kiocb *iocb, struct iov_iter *iter) if (iocb->ki_flags & IOCB_DIRECT) { struct address_space *mapping = file->f_mapping; struct inode *inode = mapping->host; + struct iov_iter data = *iter; loff_t size; size = i_size_read(inode); retval = filemap_write_and_wait_range(mapping, iocb->ki_pos, iocb->ki_pos + count - 1); - if (!retval) { - struct iov_iter data = *iter; - retval = mapping->a_ops->direct_IO(iocb, &data); - } + if (retval < 0) + goto out; + file_accessed(file); + + retval = mapping->a_ops->direct_IO(iocb, &data); if (retval > 0) { iocb->ki_pos += retval; iov_iter_advance(iter, retval); @@ -1935,10 +1937,8 @@ generic_file_read_iter(struct kiocb *iocb, struct iov_iter *iter) * DAX files, so don't bother trying. */ if (retval < 0 || !iov_iter_count(iter) || iocb->ki_pos >= size || - IS_DAX(inode)) { - file_accessed(file); + IS_DAX(inode)) goto out; - } } retval = do_generic_file_read(file, &iocb->ki_pos, iter, retval); -- 2.1.4 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] fs: update atime before I/O in generic_file_read_iter 2016-09-30 8:46 ` [PATCH 2/2] fs: update atime before I/O in generic_file_read_iter Christoph Hellwig @ 2016-10-04 8:13 ` Jan Kara 2016-10-04 11:48 ` Christoph Hellwig 0 siblings, 1 reply; 6+ messages in thread From: Jan Kara @ 2016-10-04 8:13 UTC (permalink / raw) To: Christoph Hellwig; +Cc: linux-xfs, linux-fsdevel On Fri 30-09-16 10:46:34, Christoph Hellwig wrote: > After the call to ->direct_IO the final reference to the file might have > been dropped by aio_complete already, and the call to file_accessed might > cause a use after free. > > Instead update the access time before the I/O, similar to how we > update the time stamps before writes. > > Signed-off-by: Christoph Hellwig <hch@lst.de> The patch looks good. You can add: Reviewed-by: Jan Kara <jack@suse.cz> But frankly it looks like a nasty catch that iocb->ki_filp can go away under you in the AIO case. Do I get it right that this means there must be some other thread closing your fd while the read is running, right? Also it seems that file_end_write(file) call in aio_run_iocb() is prone to the same race? Won't we be better off to just to do additional get_file() / fput() pair in the AIO submission path so that whole AIO submission path is guaranteed to have struct file available? I understand this is very performance sensitive path but we'll be adding just two atomic ops... Honza -- Jan Kara <jack@suse.com> SUSE Labs, CR ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] fs: update atime before I/O in generic_file_read_iter 2016-10-04 8:13 ` Jan Kara @ 2016-10-04 11:48 ` Christoph Hellwig 2016-10-05 8:29 ` Jan Kara 0 siblings, 1 reply; 6+ messages in thread From: Christoph Hellwig @ 2016-10-04 11:48 UTC (permalink / raw) To: Jan Kara; +Cc: Christoph Hellwig, linux-xfs, linux-fsdevel On Tue, Oct 04, 2016 at 10:13:24AM +0200, Jan Kara wrote: > But frankly it looks like a nasty catch that iocb->ki_filp can go away > under you in the AIO case. Do I get it right that this means there must be > some other thread closing your fd while the read is running, right? Yes, that's what generic/323 tests. > Also it seems that file_end_write(file) call in aio_run_iocb() is prone to > the same race? Indeed. That's easy to fix by moving the file_end_write to aio_complete, though. > Won't we be better off to just to do additional get_file() / fput() pair in > the AIO submission path so that whole AIO submission path is guaranteed to > have struct file available? I understand this is very performance sensitive > path but we'll be adding just two atomic ops... I'd rather avoid those if we can. But a big comment and some refactoring in this area would be useful to make that easier to understand. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] fs: update atime before I/O in generic_file_read_iter 2016-10-04 11:48 ` Christoph Hellwig @ 2016-10-05 8:29 ` Jan Kara 0 siblings, 0 replies; 6+ messages in thread From: Jan Kara @ 2016-10-05 8:29 UTC (permalink / raw) To: Christoph Hellwig; +Cc: Jan Kara, linux-xfs, linux-fsdevel [-- Attachment #1: Type: text/plain, Size: 941 bytes --] On Tue 04-10-16 13:48:30, Christoph Hellwig wrote: > On Tue, Oct 04, 2016 at 10:13:24AM +0200, Jan Kara wrote: > > But frankly it looks like a nasty catch that iocb->ki_filp can go away > > under you in the AIO case. Do I get it right that this means there must be > > some other thread closing your fd while the read is running, right? > > Yes, that's what generic/323 tests. > > > Also it seems that file_end_write(file) call in aio_run_iocb() is prone to > > the same race? > > Indeed. That's easy to fix by moving the file_end_write to aio_complete, > though. Now that you speak about that I even had a patch for that (attached) but Benjamin didn't quite like the lockdep dance you have to do so the patch just got dropped... Now looking at the patch the lockdep annotation actually still has the use-after-free issue and I don't see an easy way of avoiding that. Any idea? Honza -- Jan Kara <jack@suse.com> SUSE Labs, CR [-- Attachment #2: 0001-aio-Fix-freeze-protection-of-aio-writes.patch --] [-- Type: text/x-patch, Size: 2692 bytes --] >From df3f86d497e7fc11f3a03e26ee1333f2c03025e5 Mon Sep 17 00:00:00 2001 From: Jan Kara <jack@suse.cz> Date: Tue, 24 Nov 2015 14:19:22 +0100 Subject: [PATCH] aio: Fix freeze protection of aio writes Currently we dropped freeze protection of aio writes just after IO was submitted. Thus aio write could be in flight while the filesystem was frozen and that could result in unexpected situation like aio completion wanting to convert extent type on frozen filesystem. Testcase from Dmitry triggering this is like: for ((i=0;i<60;i++));do fsfreeze -f /mnt ;sleep 1;fsfreeze -u /mnt;done & fio --bs=4k --ioengine=libaio --iodepth=128 --size=1g --direct=1 \ --runtime=60 --filename=/mnt/file --name=rand-write --rw=randwrite Fix the problem by dropping freeze protection only once IO is completed in aio_complete(). Reported-by: Dmitry Monakhov <dmonakhov@openvz.org> Signed-off-by: Jan Kara <jack@suse.cz> --- fs/aio.c | 31 ++++++++++++++++++++++++++++--- include/linux/fs.h | 1 + 2 files changed, 29 insertions(+), 3 deletions(-) diff --git a/fs/aio.c b/fs/aio.c index 155f84253f33..ee0871cb4677 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -1065,6 +1065,19 @@ static void aio_complete(struct kiocb *kiocb, long res, long res2) unsigned tail, pos, head; unsigned long flags; + if (kiocb->ki_flags & IOCB_WRITE) { + struct file *f = kiocb->ki_filp; + + /* + * Tell lockdep we inherited freeze protection from submission + * thread. + */ + percpu_rwsem_acquire( + &f->f_inode->i_sb->s_writers.rw_sem[SB_FREEZE_WRITE-1], + 1, _THIS_IP_); + file_end_write(f); + } + /* * Special case handling for sync iocbs: * - events go directly into the iocb for fast handling @@ -1449,13 +1462,25 @@ rw_common: len = ret; - if (rw == WRITE) + if (rw == WRITE) { file_start_write(file); + req->ki_flags |= IOCB_WRITE; + } ret = iter_op(req, &iter); - if (rw == WRITE) - file_end_write(file); + if (rw == WRITE) { + /* + * We release freeze protection in aio_complete(). Fool + * lockdep by telling it the lock got released so that + * it doesn't complain about held lock when we return + * to userspace. + */ + percpu_rwsem_release( + &file->f_inode->i_sb->s_writers.rw_sem[SB_FREEZE_WRITE-1], + 1, _THIS_IP_); + } + kfree(iovec); break; diff --git a/include/linux/fs.h b/include/linux/fs.h index 3aa514254161..54af40ed6a26 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -319,6 +319,7 @@ struct writeback_control; #define IOCB_EVENTFD (1 << 0) #define IOCB_APPEND (1 << 1) #define IOCB_DIRECT (1 << 2) +#define IOCB_WRITE (1 << 3) struct kiocb { struct file *ki_filp; -- 2.6.2 ^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-10-05 8:29 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2016-09-30 8:46 fix struct file use after free in the AIO read path Christoph Hellwig 2016-09-30 8:46 ` [PATCH 1/2] xfs: update atime before I/O in xfs_file_dio_aio_read Christoph Hellwig 2016-09-30 8:46 ` [PATCH 2/2] fs: update atime before I/O in generic_file_read_iter Christoph Hellwig 2016-10-04 8:13 ` Jan Kara 2016-10-04 11:48 ` Christoph Hellwig 2016-10-05 8:29 ` Jan Kara
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.