From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.5 required=3.0 tests=INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CECC1C433DF for ; Tue, 9 Jun 2020 17:29:27 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 8F774207C3 for ; Tue, 9 Jun 2020 17:29:27 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 8F774207C3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 18DB56B0003; Tue, 9 Jun 2020 13:29:27 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 118706B0005; Tue, 9 Jun 2020 13:29:27 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id F220F6B0006; Tue, 9 Jun 2020 13:29:26 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0127.hostedemail.com [216.40.44.127]) by kanga.kvack.org (Postfix) with ESMTP id D783B6B0003 for ; Tue, 9 Jun 2020 13:29:26 -0400 (EDT) Received: from smtpin06.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 8D2FD182B7AAC for ; Tue, 9 Jun 2020 17:29:26 +0000 (UTC) X-FDA: 76910359932.06.shoe86_380025326dc4 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin06.hostedemail.com (Postfix) with ESMTP id 63BD110059701 for ; Tue, 9 Jun 2020 17:29:26 +0000 (UTC) X-HE-Tag: shoe86_380025326dc4 X-Filterd-Recvd-Size: 5621 Received: from mail-pf1-f195.google.com (mail-pf1-f195.google.com [209.85.210.195]) by imf08.hostedemail.com (Postfix) with ESMTP for ; Tue, 9 Jun 2020 17:29:25 +0000 (UTC) Received: by mail-pf1-f195.google.com with SMTP id x22so10369537pfn.3 for ; Tue, 09 Jun 2020 10:29:25 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=0OeLiDypwAI4S3gVXdOOM121C3htVuuP9lkSYSY9yfg=; b=Rkacwu9dzBmnf5MXX4yShp2u0RvcYUgPjAQidfWhdoXn4aoNYVjQuNxt5ri/TKlcxo Hl+tgaV4emPNquYsjXDC52FkdNP7U2xfa2T69fnHezCSMTGOeUpiI1TtDxGdztsAYGI/ kQnAS0zYnpv8RZ9CMEDd578uZOBIx76wazGWogJhWMS0F0r1vWNfvm7XZ//asSW+mAa/ HceauqatUAVy5jNFRCyUy6Z4eb3IRk0ELdmxSO6Qz1e6j3LPdhwIsXZOLWtyWCKXrkmr bZOi6bk+znHLfmQFCu1AAos2cHJs+2Ejp/M8q6trX9+hQp9oq56ZhzJul5X3Fofy/iVK DQzQ== X-Gm-Message-State: AOAM531M0dlG4GVdbDCOc6G0baRO3CWTLhM2sM4gfncI1CVy+y2dnbyT e/qeLCveD4YM8mBYnoA3/Y0= X-Google-Smtp-Source: ABdhPJw7qyoggD4kTRMCmpjIgC5B/C5Ow+WGPUmYCS78BMRrwophWg5IQ1YAU2QskReoNULrHSPqYA== X-Received: by 2002:a63:f502:: with SMTP id w2mr25064936pgh.321.1591723764725; Tue, 09 Jun 2020 10:29:24 -0700 (PDT) Received: from 42.do-not-panic.com (42.do-not-panic.com. [157.230.128.187]) by smtp.gmail.com with ESMTPSA id n1sm10777379pfd.156.2020.06.09.10.29.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Jun 2020 10:29:23 -0700 (PDT) Received: by 42.do-not-panic.com (Postfix, from userid 1000) id 7D342403AB; Tue, 9 Jun 2020 17:29:22 +0000 (UTC) Date: Tue, 9 Jun 2020 17:29:22 +0000 From: Luis Chamberlain To: Christoph Hellwig , Jan Kara Cc: axboe@kernel.dk, viro@zeniv.linux.org.uk, bvanassche@acm.org, gregkh@linuxfoundation.org, rostedt@goodmis.org, mingo@redhat.com, ming.lei@redhat.com, nstange@suse.de, akpm@linux-foundation.org, mhocko@suse.com, yukuai3@huawei.com, martin.petersen@oracle.com, jejb@linux.ibm.com, linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Omar Sandoval , Hannes Reinecke , Michal Hocko , syzbot+603294af2d01acfdd6da@syzkaller.appspotmail.com Subject: Re: [PATCH v6 6/6] blktrace: fix debugfs use after free Message-ID: <20200609172922.GP11244@42.do-not-panic.com> References: <20200608170127.20419-1-mcgrof@kernel.org> <20200608170127.20419-7-mcgrof@kernel.org> <20200609150602.GA7111@infradead.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200609150602.GA7111@infradead.org> User-Agent: Mutt/1.10.1 (2018-07-13) X-Rspamd-Queue-Id: 63BD110059701 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam03 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: I like this, more below. On Tue, Jun 09, 2020 at 08:06:02AM -0700, Christoph Hellwig wrote: > diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c > index 432fa60e7f8808..44239f603379d5 100644 > --- a/kernel/trace/blktrace.c > +++ b/kernel/trace/blktrace.c > @@ -492,34 +493,23 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, > */ > strreplace(buts->name, '/', '_'); > > - /* > - * We have to use a partition directory if a partition is being worked > - * on. The same request_queue is shared between all partitions. > - */ > - if (bdev && bdev != bdev->bd_contains) { > - dir = bdev->bd_part->debugfs_dir; > - } else if (IS_ENABLED(CONFIG_CHR_DEV_SG) && > - MAJOR(dev) == SCSI_GENERIC_MAJOR) { > + bt = kzalloc(sizeof(*bt), GFP_KERNEL); > + if (!bt) > + return -ENOMEM; > + > + if (unlikely(!bdev)) { > /* > - * scsi-generic exposes the request_queue through the /dev/sg* > - * interface but since that uses a different path than whatever > - * the respective scsi driver device name may expose and use > - * for the request_queue debugfs_dir. We have a dedicated > - * dentry for scsi-generic then. > + * When tracing something that is not a block device (e.g. the > + * /dev/sg nodes), create debugfs directory on demand. This > + * directory will be remove when stopping the trace. Is scsi-generic is the only unwanted ugly child blktrace has to deal with? For some reason I thought drivers/md/md.c was one but it seems like it is not. Do we have an easy way to search for these? I think this would just affect how we express the comment only. > */ > - dir = q->sg_debugfs_dir; > + dir = debugfs_create_dir(buts->name, blk_debugfs_root); > + bt->dir = dir; The other chicken and egg problem to consider at least in the comments is that the debugfs directory for these types of devices *have* an exposed path, but the data structure is rather opaque to the device and even blktrace. Fortunately given the recent set of changes around the q->blk_trace and clarifications around its use we have made it clear now that so long as hold the q->blk_trace_mutex *and* check q->blk_trace we *should* not race against two separate creations of debugfs directories, so I think this is safe, so long as these indpendent drivers don't end up re-using the same path for some other things later in the future, and since we have control over what goes under debugfsroot block / I think we should be good. But I think that the concern for race on names may still be worth explaining a bit here. Luis