From: John Garry <john.garry@huawei.com>
To: Bart Van Assche <bvanassche@acm.org>, <hare@suse.de>,
<ming.lei@redhat.com>, <axboe@kernel.dk>, <hch@lst.de>
Cc: <linux-block@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<pragalla@codeaurora.org>, <kashyap.desai@broadcom.com>,
<yuyufen@huawei.com>
Subject: Re: [RFC PATCH v3 3/3] blk-mq: Lockout tagset iterator when exiting elevator
Date: Wed, 10 Mar 2021 17:26:53 +0000 [thread overview]
Message-ID: <1ac95df7-db0e-2571-3953-4897cac43a6f@huawei.com> (raw)
In-Reply-To: <b74dc9ef-0db1-eb27-e2a7-c26e3dbd527a@acm.org>
On 10/03/2021 16:00, Bart Van Assche wrote:
>> So I can incorporate any changes and suggestions so far and send a
>> non-RFC version - that may get more attention if none extra comes.
>>
>> As mentioned on the cover letter, if patch 2+3/3 are accepted, then
>> patch 1/3 could be simplified. But I plan to leave as is.
>>
>> BTW, any issue with putting your suggested-by on patch 2/3?
>
Hi Bart,
>
> I have added my Reviewed-by to patch 2/3.
>
OK, thanks.
Please note that I still want to check further whether some of Ming's
series "blk-mq: implement queue quiesce via percpu_ref for
BLK_MQ_F_BLOCKING" can be used.
> Regarding the other two patches in this series: I do not agree with
> patch 3/3. As I have explained, I am concerned that that patch breaks
> existing block drivers.
Understood. I need to check your concern further to allay any fears.
So I could probably change that patch to drop the early return.
Instead we just need to ensure that we complete any existing calls to
blk_mq_tagset_busy_iter() prior to freeing the IO scheduler requests.
Then we don't need to return early and can iter as before - but, as I
said previously, there should be no active tags to iter.
>
> Are patches 1/3 and 3/3 necessary? Or in other words, is patch 2/3
> sufficient to fix the use-after-free?
No, we need them all in some form.
So far, reports are that 1/3 solves the most common seen UAF. It is
pretty easy to trigger.
But the scenarios associated with 2/3 and 3/3 are much harder to
trigger, and I needed to add delays in the code just to trigger them.
Thanks,
John
next prev parent reply other threads:[~2021-03-10 17:29 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-05 15:14 [RFC PATCH v3 0/3] blk-mq: Avoid use-after-free for accessing old requests John Garry
2021-03-05 15:14 ` [RFC PATCH v3 1/3] blk-mq: Clean up references to old requests when freeing rqs John Garry
2021-03-06 2:52 ` Khazhy Kumykov
2021-03-08 11:18 ` John Garry
2021-03-06 18:13 ` Bart Van Assche
2021-03-08 10:37 ` John Garry
2021-03-05 15:14 ` [RFC PATCH v3 2/3] blk-mq: Freeze and quiesce all queues for tagset in elevator_exit() John Garry
2021-03-06 4:32 ` Bart Van Assche
2021-03-08 10:50 ` John Garry
2021-03-08 19:35 ` Bart Van Assche
2021-03-10 15:57 ` Bart Van Assche
2021-03-11 0:58 ` Ming Lei
2021-03-11 8:21 ` John Garry
2021-03-12 23:05 ` Bart Van Assche
2021-03-16 16:15 ` John Garry
2021-03-16 17:00 ` Bart Van Assche
2021-03-16 17:43 ` John Garry
2021-03-16 19:59 ` Bart Van Assche
2021-03-19 18:19 ` John Garry
2021-03-19 18:32 ` Bart Van Assche
2021-03-05 15:14 ` [RFC PATCH v3 3/3] blk-mq: Lockout tagset iterator when exiting elevator John Garry
2021-03-06 4:43 ` Bart Van Assche
2021-03-08 11:17 ` John Garry
2021-03-08 19:59 ` Bart Van Assche
2021-03-09 17:47 ` John Garry
2021-03-09 19:21 ` Bart Van Assche
2021-03-10 8:52 ` John Garry
2021-03-10 16:00 ` Bart Van Assche
2021-03-10 17:26 ` John Garry [this message]
2021-03-18 10:26 ` [RFC PATCH v3 0/3] blk-mq: Avoid use-after-free for accessing old requests Shinichiro Kawasaki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1ac95df7-db0e-2571-3953-4897cac43a6f@huawei.com \
--to=john.garry@huawei.com \
--cc=axboe@kernel.dk \
--cc=bvanassche@acm.org \
--cc=hare@suse.de \
--cc=hch@lst.de \
--cc=kashyap.desai@broadcom.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ming.lei@redhat.com \
--cc=pragalla@codeaurora.org \
--cc=yuyufen@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).