Re: [PATCH V4 0/4] blk-mq: fix request UAF related with iterating over tagset requests

[John Garry <john.garry@huawei.com>]

On 04/05/2021 12:43, Ming Lei wrote:
>>           */
>> -       if (rq && rq->q == hctx->queue && rq->mq_hctx == hctx)
>> -               return iter_data->fn(hctx, rq, iter_data->data, reserved);
>> +       if (rq) {
>> +               mdelay(50);
>> +               if (rq->q == hctx->queue && rq->mq_hctx == hctx)
>> +   		  return iter_data->fn(hctx, rq, iter_data->data, reserved);
>> +       }
>>          return true;
>>   }
> hammmm, forget to cover bt_iter(), please test the following delta
> patch:
> 
> 
> diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
> index a3be267212b9..27815114ee3f 100644
> --- a/block/blk-mq-tag.c
> +++ b/block/blk-mq-tag.c
> @@ -206,18 +206,28 @@ static bool bt_iter(struct sbitmap *bitmap, unsigned int bitnr, void *data)
>   	struct blk_mq_tags *tags = hctx->tags;
>   	bool reserved = iter_data->reserved;
>   	struct request *rq;
> +	unsigned long flags;
> +	bool ret = true;
>   
>   	if (!reserved)
>   		bitnr += tags->nr_reserved_tags;
> -	rq = tags->rqs[bitnr];
>   
> +	spin_lock_irqsave(&tags->lock, flags);
> +	rq = tags->rqs[bitnr];
>   	/*
>   	 * We can hit rq == NULL here, because the tagging functions
>   	 * test and set the bit before assigning ->rqs[].
>   	 */
> -	if (rq && rq->q == hctx->queue && rq->mq_hctx == hctx)
> -		return iter_data->fn(hctx, rq, iter_data->data, reserved);
> -	return true;
> +	if (!rq || !refcount_inc_not_zero(&rq->ref)) {
> +		spin_unlock_irqrestore(&tags->lock, flags);
> +		return true;
> +	}
> +	spin_unlock_irqrestore(&tags->lock, flags);
> +
> +	if (rq->q == hctx->queue && rq->mq_hctx == hctx)
> +		ret = iter_data->fn(hctx, rq, iter_data->data, reserved);
> +	blk_mq_put_rq_ref(rq);
> +	return ret;
>   }


This looks to work ok from my testing.

Thanks,
John