From: Tejun Heo <tj@kernel.org>
To: Li Nan <linan122@huawei.com>
Cc: josef@toxicpanda.com, axboe@kernel.dk, cgroups@vger.kernel.org,
linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
yukuai3@huawei.com, yi.zhang@huawei.com
Subject: Re: [PATCH -next v2 7/9] blk-iocost: fix UAF in ioc_pd_free
Date: Wed, 30 Nov 2022 10:42:14 -1000 [thread overview]
Message-ID: <Y4fAJpKcVL7Q9hgY@slm.duckdns.org> (raw)
In-Reply-To: <20221130132156.2836184-8-linan122@huawei.com>
On Wed, Nov 30, 2022 at 09:21:54PM +0800, Li Nan wrote:
> T1 T2 T3
> //delete device
> del_gendisk
> bdi_unregister
> bdi_remove_from_list
> synchronize_rcu_expedited
>
> //rmdir cgroup
> blkcg_destroy_blkgs
> blkg_destroy
> percpu_ref_kill
> blkg_release
> call_rcu
> rq_qos_exit
> ioc_rqos_exit
> kfree(ioc)
> __blkg_release
> blkg_free
> blkg_free_workfn
> pd_free_fn
> ioc_pd_free
> spin_lock_irqsave
> ->ioc is freed
>
> Fix the problem by moving the operation on ioc in ioc_pd_free() to
> ioc_pd_offline(), and just free resource in ioc_pd_free() like iolatency
> and throttle.
>
> Signed-off-by: Li Nan <linan122@huawei.com>
I wonder what we really wanna do is pinning ioc while blkgs are still around
but I think this should work too.
Acked-by: Tejun Heo <tj@kernel.org>
Thanks.
--
tejun
next prev parent reply other threads:[~2022-11-30 20:42 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-30 13:21 [PATCH -next v2 0/9] iocost bugfix Li Nan
2022-11-30 13:21 ` [PATCH -next v2 1/9] blk-iocost: cleanup ioc_qos_write() and ioc_cost_model_write() Li Nan
2022-11-30 15:54 ` Christoph Hellwig
2022-11-30 15:55 ` Christoph Hellwig
2022-11-30 20:31 ` Tejun Heo
2022-11-30 13:21 ` [PATCH -next v2 2/9] blk-iocost: improve hanlder of match_u64() Li Nan
2022-11-30 20:32 ` Tejun Heo
2022-12-01 2:15 ` Yu Kuai
2022-12-01 10:08 ` Tejun Heo
2022-12-01 13:47 ` Yu Kuai
2022-11-30 13:21 ` [PATCH -next v2 3/9] blk-iocost: don't allow to configure bio based device Li Nan
2022-11-30 20:15 ` Tejun Heo
2022-11-30 13:21 ` [PATCH -next v2 4/9] blk-iocost: read params inside lock in sysfs apis Li Nan
2022-11-30 20:16 ` Tejun Heo
2022-11-30 13:21 ` [PATCH -next v2 5/9] blk-iocost: fix divide by 0 error in calc_lcoefs() Li Nan
2022-11-30 20:20 ` Tejun Heo
2022-11-30 13:21 ` [PATCH -next v2 6/9] blk-iocost: change div64_u64 to DIV64_U64_ROUND_UP in ioc_refresh_params() Li Nan
2022-11-30 20:22 ` Tejun Heo
2022-11-30 13:21 ` [PATCH -next v2 7/9] blk-iocost: fix UAF in ioc_pd_free Li Nan
2022-11-30 20:42 ` Tejun Heo [this message]
2022-12-06 7:53 ` Yu Kuai
2022-11-30 13:21 ` [PATCH -next v2 8/9] block: fix null-pointer dereference in ioc_pd_init Li Nan
2022-11-30 20:50 ` Tejun Heo
2022-12-01 2:12 ` Yu Kuai
2022-12-01 10:11 ` Tejun Heo
2022-12-01 10:23 ` Yu Kuai
2022-12-01 10:31 ` Tejun Heo
2022-12-05 9:32 ` Yu Kuai
2022-12-12 23:10 ` Tejun Heo
2022-11-30 13:21 ` [PATCH -next v2 9/9] blk-iocost: fix walk_list corruption Li Nan
2022-11-30 20:59 ` Tejun Heo
2022-12-01 1:19 ` Yu Kuai
2022-12-01 10:00 ` Tejun Heo
2022-12-01 10:14 ` Yu Kuai
2022-12-01 10:29 ` Tejun Heo
2022-12-01 13:43 ` Yu Kuai
2022-12-05 9:35 ` Yu Kuai
2022-11-30 17:26 ` [PATCH -next v2 0/9] iocost bugfix Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y4fAJpKcVL7Q9hgY@slm.duckdns.org \
--to=tj@kernel.org \
--cc=axboe@kernel.dk \
--cc=cgroups@vger.kernel.org \
--cc=josef@toxicpanda.com \
--cc=linan122@huawei.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=yi.zhang@huawei.com \
--cc=yukuai3@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).