From: Jens Axboe <axboe@kernel.dk>
To: qiang.zhang@windriver.com, asml.silence@gmail.com
Cc: io-uring@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2] io-wq: Fix UAF when wakeup wqe in hash waitqueue
Date: Wed, 26 May 2021 09:03:14 -0600 [thread overview]
Message-ID: <4b0a8cfa-938c-19fd-ee82-bd4426d55823@kernel.dk> (raw)
In-Reply-To: <20210526050826.30500-1-qiang.zhang@windriver.com>
On 5/25/21 11:08 PM, qiang.zhang@windriver.com wrote:
> From: Zqiang <qiang.zhang@windriver.com>
>
> BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650
> Read of size 8 at addr ffff8880304250d8 by task iou-wrk-28796/28802
>
> Call Trace:
> __dump_stack [inline]
> dump_stack+0x141/0x1d7
> print_address_description.constprop.0.cold+0x5b/0x2c6
> __kasan_report [inline]
> kasan_report.cold+0x7c/0xd8
> __wake_up_common+0x637/0x650
> __wake_up_common_lock+0xd0/0x130
> io_worker_handle_work+0x9dd/0x1790
> io_wqe_worker+0xb2a/0xd40
> ret_from_fork+0x1f/0x30
>
> Allocated by task 28798:
> kzalloc_node [inline]
> io_wq_create+0x3c4/0xdd0
> io_init_wq_offload [inline]
> io_uring_alloc_task_context+0x1bf/0x6b0
> __io_uring_add_task_file+0x29a/0x3c0
> io_uring_add_task_file [inline]
> io_uring_install_fd [inline]
> io_uring_create [inline]
> io_uring_setup+0x209a/0x2bd0
> do_syscall_64+0x3a/0xb0
> entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> Freed by task 28798:
> kfree+0x106/0x2c0
> io_wq_destroy+0x182/0x380
> io_wq_put [inline]
> io_wq_put_and_exit+0x7a/0xa0
> io_uring_clean_tctx [inline]
> __io_uring_cancel+0x428/0x530
> io_uring_files_cancel
> do_exit+0x299/0x2a60
> do_group_exit+0x125/0x310
> get_signal+0x47f/0x2150
> arch_do_signal_or_restart+0x2a8/0x1eb0
> handle_signal_work[inline]
> exit_to_user_mode_loop [inline]
> exit_to_user_mode_prepare+0x171/0x280
> __syscall_exit_to_user_mode_work [inline]
> syscall_exit_to_user_mode+0x19/0x60
> do_syscall_64+0x47/0xb0
> entry_SYSCALL_64_after_hwframe
>
> There are the following scenarios, hash waitqueue is shared by
> io-wq1 and io-wq2. (note: wqe is worker)
>
> io-wq1:worker2 | locks bit1
> io-wq2:worker1 | waits bit1
> io-wq1:worker3 | waits bit1
>
> io-wq1:worker2 | completes all wqe bit1 work items
> io-wq1:worker2 | drop bit1, exit
>
> io-wq2:worker1 | locks bit1
> io-wq1:worker3 | can not locks bit1, waits bit1 and exit
> io-wq1 | exit and free io-wq1
> io-wq2:worker1 | drops bit1
> io-wq1:worker3 | be waked up, even though wqe is freed
>
> After all iou-wrk belonging to io-wq1 have exited, remove wqe
> form hash waitqueue, it is guaranteed that there will be no more
> wqe belonging to io-wq1 in the hash waitqueue.
Thanks, applied.
--
Jens Axboe
prev parent reply other threads:[~2021-05-26 15:03 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-26 5:08 [PATCH v2] io-wq: Fix UAF when wakeup wqe in hash waitqueue qiang.zhang
2021-05-26 15:03 ` Jens Axboe [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4b0a8cfa-938c-19fd-ee82-bd4426d55823@kernel.dk \
--to=axboe@kernel.dk \
--cc=asml.silence@gmail.com \
--cc=io-uring@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=qiang.zhang@windriver.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.