From: Yufen Yu <yuyufen@huawei.com>
To: <axboe@kernel.dk>, <linux-block@vger.kernel.org>
Cc: <josef@toxicpanda.com>, <ming.lei@redhat.com>, <hch@lst.de>,
<bvanassche@acm.org>, <yuyufen@huawei.com>
Subject: [RFC PATCH 1/2] blk-mq: test tags bitmap before get request
Date: Sun, 28 Feb 2021 21:14:43 -0500 [thread overview]
Message-ID: <20210301021444.4134047-2-yuyufen@huawei.com> (raw)
In-Reply-To: <20210301021444.4134047-1-yuyufen@huawei.com>
For now, we set hctx->tags->rqs[i] when get driver tag successfully.
The request either comes from sched_tags->static_rqs[] with scheduler,
or comes from tags->static_rqs[] with no scheduler. But, the value won't
be clear when put driver tag. Thus, tags->rqs[i] still remain old request.
We can free these sched_tags->static_rqs[] requests when switch elevator,
update nr_requests or update nr_hw_queues. After that, unexpected access
of tags->rqs[i] may cause use-after-free crash.
For example, we reported use-after-free of request in nbd device
by syzkaller:
BUG: KASAN: use-after-free in blk_mq_request_started+0x24/0x40 block/blk-mq.c:644
Read of size 4 at addr ffff80036b77f9d4 by task kworker/u9:0/10086
Call trace:
dump_backtrace+0x0/0x310 arch/arm64/kernel/time.c:78
show_stack+0x28/0x38 arch/arm64/kernel/traps.c:158
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x144/0x1b4 lib/dump_stack.c:118
print_address_description+0x68/0x2d0 mm/kasan/report.c:253
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report+0x134/0x2f0 mm/kasan/report.c:409
check_memory_region_inline mm/kasan/kasan.c:260 [inline]
__asan_load4+0x88/0xb0 mm/kasan/kasan.c:699
__read_once_size include/linux/compiler.h:193 [inline]
blk_mq_rq_state block/blk-mq.h:106 [inline]
blk_mq_request_started+0x24/0x40 block/blk-mq.c:644
nbd_read_stat drivers/block/nbd.c:670 [inline]
recv_work+0x1bc/0x890 drivers/block/nbd.c:749
process_one_work+0x3ec/0x9e0 kernel/workqueue.c:2156
worker_thread+0x80/0x9d0 kernel/workqueue.c:2311
kthread+0x1d8/0x1e0 kernel/kthread.c:255
ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:1174
The syzkaller test program sended a reply package to client
without client sending request. After receiving the package,
recv_work() try to get the remained request in tags->rqs[]
by tag, which have been free.
To avoid this type of problem, we may need to ensure the request
valid when get it by tag.
Signed-off-by: Yufen Yu <yuyufen@huawei.com>
---
block/blk-mq.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index d4d7c1caa439..5362a7958b74 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -836,9 +836,17 @@ void blk_mq_delay_kick_requeue_list(struct request_queue *q,
}
EXPORT_SYMBOL(blk_mq_delay_kick_requeue_list);
+static int blk_mq_test_tag_bit(struct blk_mq_tags *tags, unsigned int tag)
+{
+ if (!blk_mq_tag_is_reserved(tags, tag))
+ return sbitmap_test_bit(&tags->bitmap_tags->sb, tag);
+ else
+ return sbitmap_test_bit(&tags->breserved_tags->sb, tag);
+}
+
struct request *blk_mq_tag_to_rq(struct blk_mq_tags *tags, unsigned int tag)
{
- if (tag < tags->nr_tags) {
+ if (tag < tags->nr_tags && blk_mq_test_tag_bit(tags, tag)) {
prefetch(tags->rqs[tag]);
return tags->rqs[tag];
}
--
2.25.4
next prev parent reply other threads:[~2021-03-01 2:10 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-01 2:14 [RFC PATCH 0/2] blk-mq: improve blk_mq_tag_to_rq() Yufen Yu
2021-03-01 2:14 ` Yufen Yu [this message]
2021-03-01 2:49 ` [RFC PATCH 1/2] blk-mq: test tags bitmap before get request Damien Le Moal
2021-03-01 3:49 ` Bart Van Assche
2021-03-01 7:54 ` Hannes Reinecke
2021-03-01 12:20 ` John Garry
2021-03-01 2:14 ` [RFC PATCH 2/2] blk-mq: blk_mq_tag_to_rq() always return null for sched_tags Yufen Yu
2021-03-01 2:48 ` Damien Le Moal
2021-03-01 6:50 ` Ming Lei
2021-03-01 7:33 ` Yufen Yu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210301021444.4134047-2-yuyufen@huawei.com \
--to=yuyufen@huawei.com \
--cc=axboe@kernel.dk \
--cc=bvanassche@acm.org \
--cc=hch@lst.de \
--cc=josef@toxicpanda.com \
--cc=linux-block@vger.kernel.org \
--cc=ming.lei@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.