Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH] block, bfq: fix use-after-free in
 bfq_idle_slice_timer_body
To:     Paolo Valente <paolo.valente@linaro.org>
CC:     Jens Axboe <axboe@kernel.dk>,
        linux-block <linux-block@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Mingfangsen <mingfangsen@huawei.com>,
        Yanxiaodan <yanxiaodan@huawei.com>,
        "wubo (T)" <wubo40@huawei.com>, renxudong <renxudong1@huawei.com>,
        Louhongxiang <louhongxiang@huawei.com>
References: <6c0d0b36-751b-a63a-418b-888a88ce58f4@huawei.com>
 <C69604D5-CBB7-4A5F-AD73-7A9C0B6B3360@linaro.org>
 <0a6e190a-3393-53f9-b127-d57d67cdcdc8@huawei.com>
 <4171EF13-7956-44DA-A5BF-0245E4926436@linaro.org>
From:   Zhiqiang Liu <liuzhiqiang26@huawei.com>
Message-ID: <241f9766-bfe6-485a-331c-fdc693738ffc@huawei.com>
Date:   Wed, 18 Mar 2020 17:52:15 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.2.2
MIME-Version: 1.0
In-Reply-To: <4171EF13-7956-44DA-A5BF-0245E4926436@linaro.org>
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


On 2020/3/18 16:45, Paolo Valente wrote:
> 
> 
>>>> 	spin_lock_irqsave(&bfqd->lock, flags);
>>>> -	bfq_clear_bfqq_wait_request(bfqq);
>>>> -
>>>> 	if (bfqq != bfqd->in_service_queue) {
>>>> 		spin_unlock_irqrestore(&bfqd->lock, flags);
>>>> 		return;
>>>> 	}
>>>>
>>>> +	bfq_clear_bfqq_wait_request(bfqq);
>>>> +
>>>
>>> Please add a comment on why you (correctly) clear this flag only if bfqq is in service.
>>>
>>> For the rest, seems ok to me.
>>>
>>> Thank you very much for spotting and fixing this bug,
>>> Paolo
>>>
>> Thanks for your reply.
>> Considering that the bfqq may be in race, we should firstly check whether bfqq is in service before
>> doing something on it.
>>
> 
> The comment you propose is correct, but the correctness issue I raised
> is essentially the opposite.  Sorry for not being clear.
> 
> Let me put it the other way round: why is it still correct that, if
> bfqq is not the queue in service, then that flag is not cleared at all?
> IOW, why is it not a problem that that flag remains untouched is bfqq
> is not in service?
> 
> Thanks,
> Paolo
> 
Thanks for your patient.
As you comment in bfq_idle_slice_timer, there are two race situations as follows,
a) bfqq is null
   bfq_idle_slice_timer will not call bfq_idle_slice_timer_body ->no problem
b) bfqq are not in service
   1) bfqq is freed
      it will cause use-after-free problem before calling bfq_clear_bfqq_wait_request
      in bfq_idle_slice_timer_body. -> use-after-free problem as analyzed in the patch.
   2) bfqq is not freed
      it means in_service_queue has been set to a new bfqq. The old bfqq has been expired
      through __bfq_bfqq_expire func. Then the wait_request flags of old bfqq will be cleared
      in __bfq_bfqd_reset_in_service func. -> it is no a problem to re-clear the wait_request
      flags before checking whether bfqq is in service.

In one word, the old bfqq in race has already cleared the wait_request flag when switching in_service_queue.

Thanks,
Zhiqiang Liu

>>>>
>>>
>>>
>>> .
> 
> 
> .
>