From: Luis Chamberlain <mcgrof@kernel.org>
To: Christoph Hellwig <hch@infradead.org>
Cc: axboe@kernel.dk, viro@zeniv.linux.org.uk, bvanassche@acm.org,
gregkh@linuxfoundation.org, rostedt@goodmis.org,
mingo@redhat.com, jack@suse.cz, ming.lei@redhat.com,
nstange@suse.de, akpm@linux-foundation.org, mhocko@suse.com,
yukuai3@huawei.com, linux-block@vger.kernel.org,
linux-fsdevel@vger.kernel.org, linux-mm@kvack.org,
linux-kernel@vger.kernel.org, Omar Sandoval <osandov@fb.com>,
Hannes Reinecke <hare@suse.com>, Michal Hocko <mhocko@kernel.org>,
syzbot+603294af2d01acfdd6da@syzkaller.appspotmail.com
Subject: Re: [PATCH v2 03/10] blktrace: fix debugfs use after free
Date: Wed, 22 Apr 2020 07:48:02 +0000 [thread overview]
Message-ID: <20200422074802.GS11244@42.do-not-panic.com> (raw)
In-Reply-To: <20200422072715.GC19116@infradead.org>
On Wed, Apr 22, 2020 at 12:27:15AM -0700, Christoph Hellwig wrote:
> On Sun, Apr 19, 2020 at 07:45:22PM +0000, Luis Chamberlain wrote:
> > +{
> > + struct dentry *dir = NULL;
> > +
> > + /* This can happen if we have a bug in the lower layers */
> > + dir = debugfs_lookup(kobject_name(q->kobj.parent), blk_debugfs_root);
> > + if (dir) {
> > + pr_warn("%s: registering request_queue debugfs directory twice is not allowed\n",
> > + kobject_name(q->kobj.parent));
> > + dput(dir);
> > + return -EALREADY;
> > + }
>
> I don't see why we need this check. If it is valueable enough we
> should have a debugfs_create_dir_exclusive or so that retunrns an error
> for an exsting directory, instead of reimplementing it in the caller in
> a racy way. But I'm not really sure we need it to start with.
In short races, and even with synchronous request_queue removal I'm
seeing the race is still possible, but that's due to some other races
I'm going to chase down now.
The easier solution really is to just have a debugfs dir created for
each partition if debugfs is enabled, this way the directory will
always be there, and the lookups are gone.
> > +
> > + q->debugfs_dir = debugfs_create_dir(kobject_name(q->kobj.parent),
> > + blk_debugfs_root);
> > + if (!q->debugfs_dir)
> > + return -ENOMEM;
> > +
> > + return 0;
> > +}
> > +
> > +void blk_queue_debugfs_unregister(struct request_queue *q)
> > +{
> > + debugfs_remove_recursive(q->debugfs_dir);
> > + q->debugfs_dir = NULL;
> > +}
>
> Which to me suggests we can just fold these two into the callers,
> with an IS_ENABLED for the creation case given that we check for errors
> and the stub will always return an error.
Sorry not sure I follow this.
> > debugfs_create_files(q->debugfs_dir, q, blk_mq_debugfs_queue_attrs);
> >
> > /*
> > @@ -856,9 +853,7 @@ void blk_mq_debugfs_register(struct request_queue *q)
> >
> > void blk_mq_debugfs_unregister(struct request_queue *q)
> > {
> > - debugfs_remove_recursive(q->debugfs_dir);
> > q->sched_debugfs_dir = NULL;
> > - q->debugfs_dir = NULL;
> > }
>
> This function is weird - the sched dir gets removed by the
> debugfs_remove_recursive, so just leaving a function that clears
> a pointer is rather odd. In fact I don't think we need to clear
> either sched_debugfs_dir or debugfs_dir anywhere.
Indeed. Will clean it up.
> > @@ -975,6 +976,14 @@ int blk_register_queue(struct gendisk *disk)
> > goto unlock;
> > }
> >
> > + ret = blk_queue_debugfs_register(q);
> > + if (ret) {
> > + blk_trace_remove_sysfs(dev);
> > + kobject_del(&q->kobj);
> > + kobject_put(&dev->kobj);
> > + goto unlock;
> > + }
> > +
>
> Please use a goto label to consolidate the common cleanup code.
Sure.
> Also I think these generic debugfs changes probably should be separate
> to the blktrace changes.
I'll try to do that.
> > static struct dentry *blk_trace_debugfs_dir(struct blk_user_trace_setup *buts,
> > + struct request_queue *q,
> > struct blk_trace *bt)
> > {
> > struct dentry *dir = NULL;
> >
> > + /* This can only happen if we have a bug on our lower layers */
> > + if (!q->kobj.parent) {
> > + pr_warn("%s: request_queue parent is gone\n", buts->name);
> > + return NULL;
> > + }
>
> Why is this not simply a WARN_ON_ONCE()?
I'll actually remove it and instead fix the race where it happens.
> > + if (blk_trace_target_disk(buts->name, kobject_name(q->kobj.parent))) {
> > + if (!q->debugfs_dir) {
> > + pr_warn("%s: expected request_queue debugfs_dir is not set\n",
> > + buts->name);
> > + return NULL;
> > + }
> > + /*
> > + * debugfs_lookup() is used to ensure the directory is not
> > + * taken from underneath us. We must dput() it later once
> > + * done with it within blktrace.
> > + */
> > + dir = debugfs_lookup(buts->name, blk_debugfs_root);
> > + if (!dir) {
> > + pr_warn("%s: expected request_queue debugfs_dir dentry is gone\n",
> > + buts->name);
> > + return NULL;
> > + }
> > + /*
> > + * This is a reaffirmation that debugfs_lookup() shall always
> > + * return the same dentry if it was already set.
> > + */
> > + if (dir != q->debugfs_dir) {
> > + dput(dir);
> > + pr_warn("%s: expected dentry dir != q->debugfs_dir\n",
> > + buts->name);
> > + return NULL;
> > + }
> > + bt->backing_dir = q->debugfs_dir;
> > + return bt->backing_dir;
> > + }
>
> Even with the gigantic commit log I don't get the point of this
> code. It looks rather sketchy and I can't find a rationale for it.
Yeah I think this is going to be much easier on the eyes with the
revert to synchronous request_queue removal first.
Luis
next prev parent reply other threads:[~2020-04-22 7:48 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-19 19:45 [PATCH v2 00/10] block: fix blktrace debugfs use after free Luis Chamberlain
2020-04-19 19:45 ` [PATCH v2 01/10] block: move main block debugfs initialization to its own file Luis Chamberlain
2020-04-19 21:06 ` Bart Van Assche
2020-04-19 19:45 ` [PATCH v2 02/10] blktrace: move blktrace debugfs creation to helper function Luis Chamberlain
2020-04-19 21:11 ` Bart Van Assche
2020-04-22 7:12 ` Christoph Hellwig
2020-04-19 19:45 ` [PATCH v2 03/10] blktrace: fix debugfs use after free Luis Chamberlain
2020-04-19 21:55 ` Bart Van Assche
2020-04-20 0:04 ` Luis Chamberlain
2020-04-20 0:38 ` Bart Van Assche
2020-04-20 18:46 ` Luis Chamberlain
2020-04-20 20:16 ` Greg KH
2020-04-20 20:41 ` Luis Chamberlain
2020-04-21 7:00 ` Greg KH
2020-04-22 7:28 ` Luis Chamberlain
2020-04-22 9:43 ` Ming Lei
2020-04-22 10:31 ` Luis Chamberlain
2020-04-24 23:47 ` Luis Chamberlain
2020-04-22 7:29 ` Christoph Hellwig
2020-04-22 7:34 ` Luis Chamberlain
2020-04-22 7:27 ` Christoph Hellwig
2020-04-22 7:48 ` Luis Chamberlain [this message]
2020-04-22 8:10 ` Christoph Hellwig
2020-04-22 8:26 ` Luis Chamberlain
2020-04-19 19:45 ` [PATCH v2 04/10] block: revert back to synchronous request_queue removal Luis Chamberlain
2020-04-19 22:23 ` Bart Van Assche
2020-04-20 18:59 ` Luis Chamberlain
2020-04-20 21:11 ` Bart Van Assche
2020-04-20 21:51 ` Luis Chamberlain
2020-04-19 19:45 ` [PATCH v2 05/10] blktrace: upgrade warns to BUG_ON() on unexpected circmunstances Luis Chamberlain
2020-04-19 22:50 ` Bart Van Assche
2020-04-19 23:07 ` Luis Chamberlain
2020-04-20 23:20 ` Steven Rostedt
2020-04-19 19:45 ` [PATCH v2 06/10] blk-debugfs: upgrade warns to BUG_ON() if directory is already found Luis Chamberlain
2020-04-20 11:36 ` Greg KH
2020-04-19 19:45 ` [PATCH v2 07/10] blktrace: move debugfs file creation to its own function Luis Chamberlain
2020-04-19 22:55 ` Bart Van Assche
2020-04-20 11:37 ` Greg KH
2020-04-19 19:45 ` [PATCH v2 08/10] blktrace: add checks for created debugfs files on setup Luis Chamberlain
2020-04-19 22:57 ` Bart Van Assche
2020-04-19 23:05 ` Luis Chamberlain
2020-04-19 23:17 ` Bart Van Assche
2020-04-20 11:40 ` Greg KH
2020-04-20 18:44 ` Luis Chamberlain
2020-04-20 20:11 ` Greg KH
2020-04-20 20:20 ` Luis Chamberlain
2020-04-21 6:55 ` Greg KH
2020-04-20 11:39 ` Greg KH
2020-04-19 19:45 ` [PATCH v2 09/10] block: panic if block debugfs dir is not created Luis Chamberlain
2020-04-19 23:08 ` Bart Van Assche
2020-04-20 11:38 ` Greg KH
2020-04-19 19:45 ` [PATCH v2 10/10] block: put_device() if device_add() fails Luis Chamberlain
2020-04-19 23:40 ` Bart Van Assche
2020-04-24 22:32 ` Luis Chamberlain
2020-04-25 1:58 ` Bart Van Assche
2020-04-25 2:12 ` Luis Chamberlain
2020-04-19 19:48 ` [PATCH v2 00/10] block: fix blktrace debugfs use after free Luis Chamberlain
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200422074802.GS11244@42.do-not-panic.com \
--to=mcgrof@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=axboe@kernel.dk \
--cc=bvanassche@acm.org \
--cc=gregkh@linuxfoundation.org \
--cc=hare@suse.com \
--cc=hch@infradead.org \
--cc=jack@suse.cz \
--cc=linux-block@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@kernel.org \
--cc=mhocko@suse.com \
--cc=ming.lei@redhat.com \
--cc=mingo@redhat.com \
--cc=nstange@suse.de \
--cc=osandov@fb.com \
--cc=rostedt@goodmis.org \
--cc=syzbot+603294af2d01acfdd6da@syzkaller.appspotmail.com \
--cc=viro@zeniv.linux.org.uk \
--cc=yukuai3@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).