Chagnes in v2:
- add comment in patch 2
- remove patch 4, since the problem do not exist.
Yu Kuai (3):
block, bfq: cleanup bfq_bfqq_to_bfqg()
block, bfq: avoid moving bfqq to it's parent bfqg
block, bfq: don't move oom_bfqq
block/bfq-cgroup.c | 16 +++++++++++++++-
block/bfq-iosched.c | 4 ++--
block/bfq-iosched.h | 1 -
block/bfq-wf2q.c | 15 ---------------
4 files changed, 17 insertions(+), 19 deletions(-)
--
2.31.1
Moving bfqq to it's parent bfqg is pointless.
Signed-off-by: Yu Kuai <[email protected]>
Reviewed-by: Jan Kara <[email protected]>
---
block/bfq-cgroup.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
index 09ff0bb1042c..5e65b0407e85 100644
--- a/block/bfq-cgroup.c
+++ b/block/bfq-cgroup.c
@@ -645,6 +645,14 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
struct bfq_group *bfqg)
{
struct bfq_entity *entity = &bfqq->entity;
+ struct bfq_group *old_parent = bfq_group(bfqq);
+
+ /*
+ * No point to move bfqq to the same group, which can happen when
+ * root group is offlined
+ */
+ if (old_parent == bfqg)
+ return;
/*
* Get extra reference to prevent bfqq from being freed in
@@ -666,7 +674,7 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
bfq_deactivate_bfqq(bfqd, bfqq, false, false);
else if (entity->on_st_or_in_serv)
bfq_put_idle_entity(bfq_entity_service_tree(entity), entity);
- bfqg_and_blkg_put(bfqq_group(bfqq));
+ bfqg_and_blkg_put(old_parent);
if (entity->parent &&
entity->parent->last_bfqq_created == bfqq)
--
2.31.1
Use bfq_group() instead, which do the same thing.
Signed-off-by: Yu Kuai <[email protected]>
Reviewed-by: Jan Kara <[email protected]>
---
block/bfq-iosched.c | 4 ++--
block/bfq-iosched.h | 1 -
block/bfq-wf2q.c | 15 ---------------
3 files changed, 2 insertions(+), 18 deletions(-)
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 4f671e3d2f2d..e2c49131559f 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -774,7 +774,7 @@ bfq_pos_tree_add_move(struct bfq_data *bfqd, struct bfq_queue *bfqq)
if (!bfqq->next_rq)
return;
- bfqq->pos_root = &bfq_bfqq_to_bfqg(bfqq)->rq_pos_tree;
+ bfqq->pos_root = &bfqq_group(bfqq)->rq_pos_tree;
__bfqq = bfq_rq_pos_tree_lookup(bfqd, bfqq->pos_root,
blk_rq_pos(bfqq->next_rq), &parent, &p);
if (!__bfqq) {
@@ -2669,7 +2669,7 @@ static struct bfq_queue *bfqq_find_close(struct bfq_data *bfqd,
struct bfq_queue *bfqq,
sector_t sector)
{
- struct rb_root *root = &bfq_bfqq_to_bfqg(bfqq)->rq_pos_tree;
+ struct rb_root *root = &bfqq_group(bfqq)->rq_pos_tree;
struct rb_node *parent, *node;
struct bfq_queue *__bfqq;
diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
index cc08940c87e3..6bb59ce86a86 100644
--- a/block/bfq-iosched.h
+++ b/block/bfq-iosched.h
@@ -1063,7 +1063,6 @@ extern struct blkcg_policy blkcg_policy_bfq;
for (parent = NULL; entity ; entity = parent)
#endif /* CONFIG_BFQ_GROUP_IOSCHED */
-struct bfq_group *bfq_bfqq_to_bfqg(struct bfq_queue *bfqq);
struct bfq_queue *bfq_entity_to_bfqq(struct bfq_entity *entity);
unsigned int bfq_tot_busy_queues(struct bfq_data *bfqd);
struct bfq_service_tree *bfq_entity_service_tree(struct bfq_entity *entity);
diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
index 69d169d39578..7ade26ac9cba 100644
--- a/block/bfq-wf2q.c
+++ b/block/bfq-wf2q.c
@@ -142,16 +142,6 @@ static bool bfq_update_next_in_service(struct bfq_sched_data *sd,
#ifdef CONFIG_BFQ_GROUP_IOSCHED
-struct bfq_group *bfq_bfqq_to_bfqg(struct bfq_queue *bfqq)
-{
- struct bfq_entity *group_entity = bfqq->entity.parent;
-
- if (!group_entity)
- group_entity = &bfqq->bfqd->root_group->entity;
-
- return container_of(group_entity, struct bfq_group, entity);
-}
-
/*
* Returns true if this budget changes may let next_in_service->parent
* become the next_in_service entity for its parent entity.
@@ -244,11 +234,6 @@ static void bfq_update_groups_with_pending_reqs(struct bfq_entity *entity)
#else /* CONFIG_BFQ_GROUP_IOSCHED */
-struct bfq_group *bfq_bfqq_to_bfqg(struct bfq_queue *bfqq)
-{
- return bfqq->bfqd->root_group;
-}
-
static bool bfq_update_parent_budget(struct bfq_entity *next_in_service)
{
return false;
--
2.31.1
Our test report a UAF:
[ 2073.019181] ==================================================================
[ 2073.019188] BUG: KASAN: use-after-free in __bfq_put_async_bfqq+0xa0/0x168
[ 2073.019191] Write of size 8 at addr ffff8000ccf64128 by task rmmod/72584
[ 2073.019192]
[ 2073.019196] CPU: 0 PID: 72584 Comm: rmmod Kdump: loaded Not tainted 4.19.90-yk #5
[ 2073.019198] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
[ 2073.019200] Call trace:
[ 2073.019203] dump_backtrace+0x0/0x310
[ 2073.019206] show_stack+0x28/0x38
[ 2073.019210] dump_stack+0xec/0x15c
[ 2073.019216] print_address_description+0x68/0x2d0
[ 2073.019220] kasan_report+0x238/0x2f0
[ 2073.019224] __asan_store8+0x88/0xb0
[ 2073.019229] __bfq_put_async_bfqq+0xa0/0x168
[ 2073.019233] bfq_put_async_queues+0xbc/0x208
[ 2073.019236] bfq_pd_offline+0x178/0x238
[ 2073.019240] blkcg_deactivate_policy+0x1f0/0x420
[ 2073.019244] bfq_exit_queue+0x128/0x178
[ 2073.019249] blk_mq_exit_sched+0x12c/0x160
[ 2073.019252] elevator_exit+0xc8/0xd0
[ 2073.019256] blk_exit_queue+0x50/0x88
[ 2073.019259] blk_cleanup_queue+0x228/0x3d8
[ 2073.019267] null_del_dev+0xfc/0x1e0 [null_blk]
[ 2073.019274] null_exit+0x90/0x114 [null_blk]
[ 2073.019278] __arm64_sys_delete_module+0x358/0x5a0
[ 2073.019282] el0_svc_common+0xc8/0x320
[ 2073.019287] el0_svc_handler+0xf8/0x160
[ 2073.019290] el0_svc+0x10/0x218
[ 2073.019291]
[ 2073.019294] Allocated by task 14163:
[ 2073.019301] kasan_kmalloc+0xe0/0x190
[ 2073.019305] kmem_cache_alloc_node_trace+0x1cc/0x418
[ 2073.019308] bfq_pd_alloc+0x54/0x118
[ 2073.019313] blkcg_activate_policy+0x250/0x460
[ 2073.019317] bfq_create_group_hierarchy+0x38/0x110
[ 2073.019321] bfq_init_queue+0x6d0/0x948
[ 2073.019325] blk_mq_init_sched+0x1d8/0x390
[ 2073.019330] elevator_switch_mq+0x88/0x170
[ 2073.019334] elevator_switch+0x140/0x270
[ 2073.019338] elv_iosched_store+0x1a4/0x2a0
[ 2073.019342] queue_attr_store+0x90/0xe0
[ 2073.019348] sysfs_kf_write+0xa8/0xe8
[ 2073.019351] kernfs_fop_write+0x1f8/0x378
[ 2073.019359] __vfs_write+0xe0/0x360
[ 2073.019363] vfs_write+0xf0/0x270
[ 2073.019367] ksys_write+0xdc/0x1b8
[ 2073.019371] __arm64_sys_write+0x50/0x60
[ 2073.019375] el0_svc_common+0xc8/0x320
[ 2073.019380] el0_svc_handler+0xf8/0x160
[ 2073.019383] el0_svc+0x10/0x218
[ 2073.019385]
[ 2073.019387] Freed by task 72584:
[ 2073.019391] __kasan_slab_free+0x120/0x228
[ 2073.019394] kasan_slab_free+0x10/0x18
[ 2073.019397] kfree+0x94/0x368
[ 2073.019400] bfqg_put+0x64/0xb0
[ 2073.019404] bfqg_and_blkg_put+0x90/0xb0
[ 2073.019408] bfq_put_queue+0x220/0x228
[ 2073.019413] __bfq_put_async_bfqq+0x98/0x168
[ 2073.019416] bfq_put_async_queues+0xbc/0x208
[ 2073.019420] bfq_pd_offline+0x178/0x238
[ 2073.019424] blkcg_deactivate_policy+0x1f0/0x420
[ 2073.019429] bfq_exit_queue+0x128/0x178
[ 2073.019433] blk_mq_exit_sched+0x12c/0x160
[ 2073.019437] elevator_exit+0xc8/0xd0
[ 2073.019440] blk_exit_queue+0x50/0x88
[ 2073.019443] blk_cleanup_queue+0x228/0x3d8
[ 2073.019451] null_del_dev+0xfc/0x1e0 [null_blk]
[ 2073.019459] null_exit+0x90/0x114 [null_blk]
[ 2073.019462] __arm64_sys_delete_module+0x358/0x5a0
[ 2073.019467] el0_svc_common+0xc8/0x320
[ 2073.019471] el0_svc_handler+0xf8/0x160
[ 2073.019474] el0_svc+0x10/0x218
[ 2073.019475]
[ 2073.019479] The buggy address belongs to the object at ffff8000ccf63f00
which belongs to the cache kmalloc-1024 of size 1024
[ 2073.019484] The buggy address is located 552 bytes inside of
1024-byte region [ffff8000ccf63f00, ffff8000ccf64300)
[ 2073.019486] The buggy address belongs to the page:
[ 2073.019492] page:ffff7e000333d800 count:1 mapcount:0 mapping:ffff8000c0003a00 index:0x0 compound_mapcount: 0
[ 2073.020123] flags: 0x7ffff0000008100(slab|head)
[ 2073.020403] raw: 07ffff0000008100 ffff7e0003334c08 ffff7e00001f5a08 ffff8000c0003a00
[ 2073.020409] raw: 0000000000000000 00000000001c001c 00000001ffffffff 0000000000000000
[ 2073.020411] page dumped because: kasan: bad access detected
[ 2073.020412]
[ 2073.020414] Memory state around the buggy address:
[ 2073.020420] ffff8000ccf64000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 2073.020424] ffff8000ccf64080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 2073.020428] >ffff8000ccf64100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 2073.020430] ^
[ 2073.020434] ffff8000ccf64180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 2073.020438] ffff8000ccf64200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 2073.020439] ==================================================================
The same problem exist in mainline as well.
This is because oom_bfqq is moved to a non-root group, thus root_group
is freed earlier.
Thus fix the problem by don't move oom_bfqq.
Signed-off-by: Yu Kuai <[email protected]>
Reviewed-by: Jan Kara <[email protected]>
---
block/bfq-cgroup.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
index 5e65b0407e85..22dd5b7229ae 100644
--- a/block/bfq-cgroup.c
+++ b/block/bfq-cgroup.c
@@ -654,6 +654,12 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
if (old_parent == bfqg)
return;
+ /*
+ * oom_bfqq is not allowed to move, oom_bfqq will hold ref to root_group
+ * until elevator exit.
+ */
+ if (bfqq == &bfqd->oom_bfqq)
+ return;
/*
* Get extra reference to prevent bfqq from being freed in
* next possible expire or deactivate.
--
2.31.1
?? 2021/12/31 11:23, Yu Kuai д??:
> Chagnes in v2:
> - add comment in patch 2
> - remove patch 4, since the problem do not exist.
>
friendly ping ...
> Yu Kuai (3):
> block, bfq: cleanup bfq_bfqq_to_bfqg()
> block, bfq: avoid moving bfqq to it's parent bfqg
> block, bfq: don't move oom_bfqq
>
> block/bfq-cgroup.c | 16 +++++++++++++++-
> block/bfq-iosched.c | 4 ++--
> block/bfq-iosched.h | 1 -
> block/bfq-wf2q.c | 15 ---------------
> 4 files changed, 17 insertions(+), 19 deletions(-)
>
在 2022/01/11 9:40, yukuai (C) 写道:
> 在 2021/12/31 11:23, Yu Kuai 写道:
>> Chagnes in v2:
>> - add comment in patch 2
>> - remove patch 4, since the problem do not exist.
>>
> friendly ping ...
Hi, Jens
Can this patchset be applied?
Thanks
>> Yu Kuai (3):
>> block, bfq: cleanup bfq_bfqq_to_bfqg()
>> block, bfq: avoid moving bfqq to it's parent bfqg
>> block, bfq: don't move oom_bfqq
>>
>> block/bfq-cgroup.c | 16 +++++++++++++++-
>> block/bfq-iosched.c | 4 ++--
>> block/bfq-iosched.h | 1 -
>> block/bfq-wf2q.c | 15 ---------------
>> 4 files changed, 17 insertions(+), 19 deletions(-)
>>
On Fri 14-01-22 16:23:36, yukuai (C) wrote:
> 在 2022/01/11 9:40, yukuai (C) 写道:
> > 在 2021/12/31 11:23, Yu Kuai 写道:
> > > Chagnes in v2:
> > > - add comment in patch 2
> > > - remove patch 4, since the problem do not exist.
> > >
> > friendly ping ...
>
> Hi, Jens
>
> Can this patchset be applied?
Maybe Jens is waiting for Paolo's ack as a BFQ maintainer. Paolo, what do
you think about the cleanups? They seem mostly obvious to me...
Honza
>
> Thanks
> > > Yu Kuai (3):
> > > block, bfq: cleanup bfq_bfqq_to_bfqg()
> > > block, bfq: avoid moving bfqq to it's parent bfqg
> > > block, bfq: don't move oom_bfqq
> > >
> > > block/bfq-cgroup.c | 16 +++++++++++++++-
> > > block/bfq-iosched.c | 4 ++--
> > > block/bfq-iosched.h | 1 -
> > > block/bfq-wf2q.c | 15 ---------------
> > > 4 files changed, 17 insertions(+), 19 deletions(-)
> > >
--
Jan Kara <[email protected]>
SUSE Labs, CR
> Il giorno 31 dic 2021, alle ore 04:23, Yu Kuai <[email protected]> ha scritto:
>
> Chagnes in v2:
> - add comment in patch 2
> - remove patch 4, since the problem do not exist.
>
> Yu Kuai (3):
> block, bfq: cleanup bfq_bfqq_to_bfqg()
> block, bfq: avoid moving bfqq to it's parent bfqg
> block, bfq: don't move oom_bfqq
>
All
Acked-by: Paolo Valente <[email protected]>
Thanks,
Paolo
> block/bfq-cgroup.c | 16 +++++++++++++++-
> block/bfq-iosched.c | 4 ++--
> block/bfq-iosched.h | 1 -
> block/bfq-wf2q.c | 15 ---------------
> 4 files changed, 17 insertions(+), 19 deletions(-)
>
> --
> 2.31.1
>
?? 2021/12/31 11:23, Yu Kuai д??:
> Chagnes in v2:
> - add comment in patch 2
> - remove patch 4, since the problem do not exist.
>
> Yu Kuai (3):
> block, bfq: cleanup bfq_bfqq_to_bfqg()
> block, bfq: avoid moving bfqq to it's parent bfqg
> block, bfq: don't move oom_bfqq
>
> block/bfq-cgroup.c | 16 +++++++++++++++-
> block/bfq-iosched.c | 4 ++--
> block/bfq-iosched.h | 1 -
> block/bfq-wf2q.c | 15 ---------------
> 4 files changed, 17 insertions(+), 19 deletions(-)
>
Hi, jens
Now that with acked-by Paolo, can you please applied this pathset?
Thanks,
Kuai
在 2022/01/24 11:46, yukuai (C) 写道:
> 在 2021/12/31 11:23, Yu Kuai 写道:
>> Chagnes in v2:
>> - add comment in patch 2
>> - remove patch 4, since the problem do not exist.
>>
>> Yu Kuai (3):
>> block, bfq: cleanup bfq_bfqq_to_bfqg()
>> block, bfq: avoid moving bfqq to it's parent bfqg
>> block, bfq: don't move oom_bfqq
>>
>> block/bfq-cgroup.c | 16 +++++++++++++++-
>> block/bfq-iosched.c | 4 ++--
>> block/bfq-iosched.h | 1 -
>> block/bfq-wf2q.c | 15 ---------------
>> 4 files changed, 17 insertions(+), 19 deletions(-)
>>
> Hi, jens
>
> Now that with acked-by Paolo, can you please applied this pathset?
friendly ping ...
>
> Thanks,
> Kuai
On Fri, 31 Dec 2021 11:23:51 +0800, Yu Kuai wrote:
> Chagnes in v2:
> - add comment in patch 2
> - remove patch 4, since the problem do not exist.
>
> Yu Kuai (3):
> block, bfq: cleanup bfq_bfqq_to_bfqg()
> block, bfq: avoid moving bfqq to it's parent bfqg
> block, bfq: don't move oom_bfqq
>
> [...]
Applied, thanks!
[1/3] block, bfq: cleanup bfq_bfqq_to_bfqg()
commit: a9c77f6ec0b566439182a10b64dd3e60a0408849
[2/3] block, bfq: avoid moving bfqq to it's parent bfqg
commit: 36ad7fe0ec7485ee435f7a40452c7a58598779d4
[3/3] block, bfq: don't move oom_bfqq
commit: a0b98e6fba18a40aa9672cc3e0abf980456f3ae6
Best regards,
--
Jens Axboe
On 1/28/22 7:45 AM, Jens Axboe wrote:
> On Fri, 31 Dec 2021 11:23:51 +0800, Yu Kuai wrote:
>> Chagnes in v2:
>> - add comment in patch 2
>> - remove patch 4, since the problem do not exist.
>>
>> Yu Kuai (3):
>> block, bfq: cleanup bfq_bfqq_to_bfqg()
>> block, bfq: avoid moving bfqq to it's parent bfqg
>> block, bfq: don't move oom_bfqq
>>
>> [...]
>
> Applied, thanks!
>
> [1/3] block, bfq: cleanup bfq_bfqq_to_bfqg()
> commit: a9c77f6ec0b566439182a10b64dd3e60a0408849
> [2/3] block, bfq: avoid moving bfqq to it's parent bfqg
> commit: 36ad7fe0ec7485ee435f7a40452c7a58598779d4
> [3/3] block, bfq: don't move oom_bfqq
> commit: a0b98e6fba18a40aa9672cc3e0abf980456f3ae6
For all those pings, this patchset sure didn't see a lot of compiles:
block/bfq-cgroup.c: In function ‘bfq_bfqq_move’:
block/bfq-cgroup.c:648:40: error: implicit declaration of function ‘bfq_group’; did you mean ‘bfqq_group’? [-Werror=implicit-function-declaration]
648 | struct bfq_group *old_parent = bfq_group(bfqq);
| ^~~~~~~~~
| bfqq_group
block/bfq-cgroup.c:648:40: error: initialization of ‘struct bfq_group *’ from ‘int’ makes pointer from integer without a cast [-Werror=int-conversion]
cc1: all warnings being treated as errors
make[1]: *** [scripts/Makefile.build:288: block/bfq-cgroup.o] Error 1
make: *** [Makefile:1831: block] Error 2
Dropped.
--
Jens Axboe
在 2022/01/29 3:27, Jens Axboe 写道:
> On 1/28/22 7:45 AM, Jens Axboe wrote:
>> On Fri, 31 Dec 2021 11:23:51 +0800, Yu Kuai wrote:
>>> Chagnes in v2:
>>> - add comment in patch 2
>>> - remove patch 4, since the problem do not exist.
>>>
>>> Yu Kuai (3):
>>> block, bfq: cleanup bfq_bfqq_to_bfqg()
>>> block, bfq: avoid moving bfqq to it's parent bfqg
>>> block, bfq: don't move oom_bfqq
>>>
>>> [...]
>>
>> Applied, thanks!
>>
>> [1/3] block, bfq: cleanup bfq_bfqq_to_bfqg()
>> commit: a9c77f6ec0b566439182a10b64dd3e60a0408849
>> [2/3] block, bfq: avoid moving bfqq to it's parent bfqg
>> commit: 36ad7fe0ec7485ee435f7a40452c7a58598779d4
>> [3/3] block, bfq: don't move oom_bfqq
>> commit: a0b98e6fba18a40aa9672cc3e0abf980456f3ae6
>
> For all those pings, this patchset sure didn't see a lot of compiles:
>
> block/bfq-cgroup.c: In function ‘bfq_bfqq_move’:
> block/bfq-cgroup.c:648:40: error: implicit declaration of function ‘bfq_group’; did you mean ‘bfqq_group’? [-Werror=implicit-function-declaration]
> 648 | struct bfq_group *old_parent = bfq_group(bfqq);
> | ^~~~~~~~~
> | bfqq_group
> block/bfq-cgroup.c:648:40: error: initialization of ‘struct bfq_group *’ from ‘int’ makes pointer from integer without a cast [-Werror=int-conversion]
> cc1: all warnings being treated as errors
> make[1]: *** [scripts/Makefile.build:288: block/bfq-cgroup.o] Error 1
> make: *** [Makefile:1831: block] Error 2
>
> Dropped.
>
Hi,
I'm sincerely sorry for this, I do forget to compiles this patchset,
and let this stupid clerical error exposure to you...
I'll send anothor version of patch 2.
Thanks,
Kuai