From: Paolo Valente <paolo.valente@linaro.org>
To: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Cc: Jens Axboe <axboe@kernel.dk>,
linux-block <linux-block@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Mingfangsen <mingfangsen@huawei.com>,
Yanxiaodan <yanxiaodan@huawei.com>,
"wubo (T)" <wubo40@huawei.com>, renxudong <renxudong1@huawei.com>,
Louhongxiang <louhongxiang@huawei.com>
Subject: Re: [PATCH] block, bfq: fix use-after-free in bfq_idle_slice_timer_body
Date: Wed, 18 Mar 2020 12:07:37 +0100 [thread overview]
Message-ID: <A7FFF605-BAA8-42C1-B648-1D5BA17D1286@linaro.org> (raw)
In-Reply-To: <241f9766-bfe6-485a-331c-fdc693738ffc@huawei.com>
> Il giorno 18 mar 2020, alle ore 10:52, Zhiqiang Liu <liuzhiqiang26@huawei.com> ha scritto:
>
>
>
> On 2020/3/18 16:45, Paolo Valente wrote:
>>
>>
>>>>> spin_lock_irqsave(&bfqd->lock, flags);
>>>>> - bfq_clear_bfqq_wait_request(bfqq);
>>>>> -
>>>>> if (bfqq != bfqd->in_service_queue) {
>>>>> spin_unlock_irqrestore(&bfqd->lock, flags);
>>>>> return;
>>>>> }
>>>>>
>>>>> + bfq_clear_bfqq_wait_request(bfqq);
>>>>> +
>>>>
>>>> Please add a comment on why you (correctly) clear this flag only if bfqq is in service.
>>>>
>>>> For the rest, seems ok to me.
>>>>
>>>> Thank you very much for spotting and fixing this bug,
>>>> Paolo
>>>>
>>> Thanks for your reply.
>>> Considering that the bfqq may be in race, we should firstly check whether bfqq is in service before
>>> doing something on it.
>>>
>>
>> The comment you propose is correct, but the correctness issue I raised
>> is essentially the opposite. Sorry for not being clear.
>>
>> Let me put it the other way round: why is it still correct that, if
>> bfqq is not the queue in service, then that flag is not cleared at all?
>> IOW, why is it not a problem that that flag remains untouched is bfqq
>> is not in service?
>>
>> Thanks,
>> Paolo
>>
> Thanks for your patient.
> As you comment in bfq_idle_slice_timer, there are two race situations as follows,
> a) bfqq is null
> bfq_idle_slice_timer will not call bfq_idle_slice_timer_body ->no problem
> b) bfqq are not in service
> 1) bfqq is freed
> it will cause use-after-free problem before calling bfq_clear_bfqq_wait_request
> in bfq_idle_slice_timer_body. -> use-after-free problem as analyzed in the patch.
> 2) bfqq is not freed
> it means in_service_queue has been set to a new bfqq. The old bfqq has been expired
> through __bfq_bfqq_expire func. Then the wait_request flags of old bfqq will be cleared
> in __bfq_bfqd_reset_in_service func. -> it is no a problem to re-clear the wait_request
> flags before checking whether bfqq is in service.
Great, this item 2 is exactly what I meant. We need a comment
because, even if now this stuff is clear to you, imagine somebody
else getting to your modified piece of code after reading hundreds of
lines of code, about a non-trivial state machine as BFQ ... :)
Thanks,
Paolo
>
> In one word, the old bfqq in race has already cleared the wait_request flag when switching in_service_queue.
>
> Thanks,
> Zhiqiang Liu
>
>>>>>
>>>>
>>>>
>>>> .
>>
>>
>> .
>>
>
next prev parent reply other threads:[~2020-03-18 11:07 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-17 14:06 [PATCH] block, bfq: fix use-after-free in bfq_idle_slice_timer_body Zhiqiang Liu
2020-03-17 17:44 ` Paolo Valente
2020-03-18 1:35 ` Zhiqiang Liu
2020-03-18 8:45 ` Paolo Valente
2020-03-18 9:52 ` Zhiqiang Liu
2020-03-18 11:07 ` Paolo Valente [this message]
2020-03-19 1:42 ` Zhiqiang Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=A7FFF605-BAA8-42C1-B648-1D5BA17D1286@linaro.org \
--to=paolo.valente@linaro.org \
--cc=axboe@kernel.dk \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=liuzhiqiang26@huawei.com \
--cc=louhongxiang@huawei.com \
--cc=mingfangsen@huawei.com \
--cc=renxudong1@huawei.com \
--cc=wubo40@huawei.com \
--cc=yanxiaodan@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).