Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH] block: Fix use-after-free issue accessing struct io_cq
To:     Sahitya Tummala <stummala@codeaurora.org>,
        linux-block@vger.kernel.org
Cc:     linux-kernel@vger.kernel.org, Pradeep P V K <ppvk@codeaurora.org>
References: <1583923070-22245-1-git-send-email-stummala@codeaurora.org>
From:   Jens Axboe <axboe@kernel.dk>
Message-ID: <da11e249-904f-6cec-03b6-ce4b8d7eb1e1@kernel.dk>
Date:   Wed, 11 Mar 2020 06:59:34 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.4.1
MIME-Version: 1.0
In-Reply-To: <1583923070-22245-1-git-send-email-stummala@codeaurora.org>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 3/11/20 4:37 AM, Sahitya Tummala wrote:
> There is a potential race between ioc_release_fn() and
> ioc_clear_queue() as shown below, due to which below kernel
> crash is observed. It also can result into use-after-free
> issue.
> 
> context#1:				context#2:
> ioc_release_fn()			__ioc_clear_queue() gets the same icq
> ->spin_lock(&ioc->lock);		->spin_lock(&ioc->lock);
> ->ioc_destroy_icq(icq);
>   ->list_del_init(&icq->q_node);
>   ->call_rcu(&icq->__rcu_head,
>   	icq_free_icq_rcu);
> ->spin_unlock(&ioc->lock);
> 					->ioc_destroy_icq(icq);
> 					  ->hlist_del_init(&icq->ioc_node);
> 					  This results into below crash as this memory
> 					  is now used by icq->__rcu_head in context#1.
> 					  There is a chance that icq could be free'd
> 					  as well.
> 
> 22150.386550:   <6> Unable to handle kernel write to read-only memory
> at virtual address ffffffaa8d31ca50

Fix looks good to me, applied.

-- 
Jens Axboe