fix struct file use after free in the AIO read path

fix struct file use after free in the AIO read path

[Christoph Hellwig]

We can't use struct file after we have submitted I/O because aio_complete
might have done the final fput on it already.  Fix this by updating the
atime before performing I/O.

[PATCH 1/2] xfs: update atime before I/O in xfs_file_dio_aio_read

[Christoph Hellwig]

After the call to __blkdev_direct_IO the final reference to the file
might have been dropped by aio_complete already, and the call to
file_accessed might cause a use after free.

Instead update the access time before the I/O, similar to how we
update the time stamps before writes.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reported-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Tested-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 fs/xfs/xfs_file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index ef01bd3..301fb3c 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -270,6 +270,8 @@ xfs_file_dio_aio_read(
 		return -EINVAL;
 	}
 
+	file_accessed(iocb->ki_filp);
+
 	/*
 	 * Locking is a bit tricky here. If we take an exclusive lock for direct
 	 * IO, we effectively serialise all new concurrent read IO to this file
@@ -324,7 +326,6 @@ xfs_file_dio_aio_read(
 	}
 	xfs_rw_iunlock(ip, XFS_IOLOCK_SHARED);
 
-	file_accessed(iocb->ki_filp);
 	return ret;
 }
 
-- 
2.1.4

[PATCH 2/2] fs: update atime before I/O in generic_file_read_iter

[Christoph Hellwig]

After the call to ->direct_IO the final reference to the file might have
been dropped by aio_complete already, and the call to file_accessed might
cause a use after free.

Instead update the access time before the I/O, similar to how we
update the time stamps before writes.

Signed-off-by: Christoph Hellwig <hch@lst.de>
---
 mm/filemap.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/mm/filemap.c b/mm/filemap.c
index 8a287df..2f1175e 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1910,16 +1910,18 @@ generic_file_read_iter(struct kiocb *iocb, struct iov_iter *iter)
 	if (iocb->ki_flags & IOCB_DIRECT) {
 		struct address_space *mapping = file->f_mapping;
 		struct inode *inode = mapping->host;
+		struct iov_iter data = *iter;
 		loff_t size;
 
 		size = i_size_read(inode);
 		retval = filemap_write_and_wait_range(mapping, iocb->ki_pos,
 					iocb->ki_pos + count - 1);
-		if (!retval) {
-			struct iov_iter data = *iter;
-			retval = mapping->a_ops->direct_IO(iocb, &data);
-		}
+		if (retval < 0)
+			goto out;
 
+		file_accessed(file);
+
+		retval = mapping->a_ops->direct_IO(iocb, &data);
 		if (retval > 0) {
 			iocb->ki_pos += retval;
 			iov_iter_advance(iter, retval);
@@ -1935,10 +1937,8 @@ generic_file_read_iter(struct kiocb *iocb, struct iov_iter *iter)
 		 * DAX files, so don't bother trying.
 		 */
 		if (retval < 0 || !iov_iter_count(iter) || iocb->ki_pos >= size ||
-		    IS_DAX(inode)) {
-			file_accessed(file);
+		    IS_DAX(inode))
 			goto out;
-		}
 	}
 
 	retval = do_generic_file_read(file, &iocb->ki_pos, iter, retval);
-- 
2.1.4

Re: [PATCH 2/2] fs: update atime before I/O in generic_file_read_iter

[Jan Kara]

On Fri 30-09-16 10:46:34, Christoph Hellwig wrote:
> After the call to ->direct_IO the final reference to the file might have
> been dropped by aio_complete already, and the call to file_accessed might
> cause a use after free.
> 
> Instead update the access time before the I/O, similar to how we
> update the time stamps before writes.
> 
> Signed-off-by: Christoph Hellwig <hch@lst.de>

The patch looks good. You can add:

Reviewed-by: Jan Kara <jack@suse.cz>

But frankly it looks like a nasty catch that iocb->ki_filp can go away
under you in the AIO case. Do I get it right that this means there must be
some other thread closing your fd while the read is running, right?

Also it seems that file_end_write(file) call in aio_run_iocb() is prone to
the same race?

Won't we be better off to just to do additional get_file() / fput() pair in
the AIO submission path so that whole AIO submission path is guaranteed to
have struct file available? I understand this is very performance sensitive
path but we'll be adding just two atomic ops...

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

Re: [PATCH 2/2] fs: update atime before I/O in generic_file_read_iter

[Christoph Hellwig]

On Tue, Oct 04, 2016 at 10:13:24AM +0200, Jan Kara wrote:
> But frankly it looks like a nasty catch that iocb->ki_filp can go away
> under you in the AIO case. Do I get it right that this means there must be
> some other thread closing your fd while the read is running, right?

Yes, that's what generic/323 tests.

> Also it seems that file_end_write(file) call in aio_run_iocb() is prone to
> the same race?

Indeed.  That's easy to fix by moving the file_end_write to aio_complete,
though.

> Won't we be better off to just to do additional get_file() / fput() pair in
> the AIO submission path so that whole AIO submission path is guaranteed to
> have struct file available? I understand this is very performance sensitive
> path but we'll be adding just two atomic ops...

I'd rather avoid those if we can.  But a big comment and some refactoring
in this area would be useful to make that easier to understand.

Re: [PATCH 2/2] fs: update atime before I/O in generic_file_read_iter

[Jan Kara]

[-- Attachment #1: Type: text/plain, Size: 941 bytes --]

On Tue 04-10-16 13:48:30, Christoph Hellwig wrote:
> On Tue, Oct 04, 2016 at 10:13:24AM +0200, Jan Kara wrote:
> > But frankly it looks like a nasty catch that iocb->ki_filp can go away
> > under you in the AIO case. Do I get it right that this means there must be
> > some other thread closing your fd while the read is running, right?
> 
> Yes, that's what generic/323 tests.
> 
> > Also it seems that file_end_write(file) call in aio_run_iocb() is prone to
> > the same race?
> 
> Indeed.  That's easy to fix by moving the file_end_write to aio_complete,
> though.

Now that you speak about that I even had a patch for that (attached) but
Benjamin didn't quite like the lockdep dance you have to do so the patch
just got dropped... Now looking at the patch the lockdep annotation
actually still has the use-after-free issue and I don't see an easy way of
avoiding that. Any idea?

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

[-- Attachment #2: 0001-aio-Fix-freeze-protection-of-aio-writes.patch --]
[-- Type: text/x-patch, Size: 2692 bytes --]

>From df3f86d497e7fc11f3a03e26ee1333f2c03025e5 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Tue, 24 Nov 2015 14:19:22 +0100
Subject: [PATCH] aio: Fix freeze protection of aio writes

Currently we dropped freeze protection of aio writes just after IO was
submitted. Thus aio write could be in flight while the filesystem was
frozen and that could result in unexpected situation like aio completion
wanting to convert extent type on frozen filesystem. Testcase from
Dmitry triggering this is like:

for ((i=0;i<60;i++));do fsfreeze -f /mnt ;sleep 1;fsfreeze -u /mnt;done &
fio --bs=4k --ioengine=libaio --iodepth=128 --size=1g --direct=1 \
    --runtime=60 --filename=/mnt/file --name=rand-write --rw=randwrite

Fix the problem by dropping freeze protection only once IO is completed
in aio_complete().

Reported-by: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: Jan Kara <jack@suse.cz>
---
 fs/aio.c           | 31 ++++++++++++++++++++++++++++---
 include/linux/fs.h |  1 +
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/fs/aio.c b/fs/aio.c
index 155f84253f33..ee0871cb4677 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1065,6 +1065,19 @@ static void aio_complete(struct kiocb *kiocb, long res, long res2)
 	unsigned tail, pos, head;
 	unsigned long	flags;
 
+	if (kiocb->ki_flags & IOCB_WRITE) {
+		struct file *f = kiocb->ki_filp;
+
+		/*
+		 * Tell lockdep we inherited freeze protection from submission
+		 * thread.
+		 */
+		percpu_rwsem_acquire(
+			&f->f_inode->i_sb->s_writers.rw_sem[SB_FREEZE_WRITE-1],
+			1, _THIS_IP_);
+		file_end_write(f);
+	}
+
 	/*
 	 * Special case handling for sync iocbs:
 	 *  - events go directly into the iocb for fast handling
@@ -1449,13 +1462,25 @@ rw_common:
 
 		len = ret;
 
-		if (rw == WRITE)
+		if (rw == WRITE) {
 			file_start_write(file);
+			req->ki_flags |= IOCB_WRITE;
+		}
 
 		ret = iter_op(req, &iter);
 
-		if (rw == WRITE)
-			file_end_write(file);
+		if (rw == WRITE) {
+			/*
+			 * We release freeze protection in aio_complete(). Fool
+			 * lockdep by telling it the lock got released so that
+			 * it doesn't complain about held lock when we return
+			 * to userspace.
+			 */
+			percpu_rwsem_release(
+				&file->f_inode->i_sb->s_writers.rw_sem[SB_FREEZE_WRITE-1],
+				1, _THIS_IP_);
+		}
+
 		kfree(iovec);
 		break;
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 3aa514254161..54af40ed6a26 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -319,6 +319,7 @@ struct writeback_control;
 #define IOCB_EVENTFD		(1 << 0)
 #define IOCB_APPEND		(1 << 1)
 #define IOCB_DIRECT		(1 << 2)
+#define IOCB_WRITE		(1 << 3)
 
 struct kiocb {
 	struct file		*ki_filp;
-- 
2.6.2