Received: by 2002:a25:6193:0:0:0:0:0 with SMTP id v141csp2087079ybb; Thu, 9 Apr 2020 15:02:17 -0700 (PDT) X-Google-Smtp-Source: APiQypLpJCyZ6uG762LfzVyeHCJTWco0I3UY/rHDGAgvwlyv9d4BXQRbjIGSAcg9W7++IkilBSQX X-Received: by 2002:ac8:3808:: with SMTP id q8mr1595458qtb.245.1586469737541; Thu, 09 Apr 2020 15:02:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1586469737; cv=none; d=google.com; s=arc-20160816; b=fQHlO/ZVYbgIfZlCTwZDprvxK6rU8QFXD/C6MJz37OI5Emetbkb/DHVW0s7/wiV6nW QJVHqPiLise0HlIEX7yrrWnf/T8PWw1vaPbF84D2y9TGOW7q7aKXhRIo+4PuqYsstfOb onZlpGDuEmFnMmY+s5fjYU1glz6q0rOWpOVN0Ft/9azjGt30aYych2H9NaYSLWA95oIs SMRsWJL0ZkIaqUKk1NdLbJ/kqgluxaBrrlXk7e6nlgZ36SCJjKi/Fgy6Gm/N/xhOgHZh 6DzYlPYaxhQiEe7ex7XKptIMifMQpLpkg1DuFKTqcopWjycWri5WbglvI8/kF12SS9BV wzIQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:cc:to:subject :message-id:date:from:in-reply-to:references:mime-version :dkim-signature; bh=3PMykgIeHcpYK7E84bckGD4k1kFjTw+cB7ok0aY7S2c=; b=w2a5bdf9pjWXDPTIh8gzrpXkVfvlYOAS6CE07JE9xgk3YqBsNHiydigSiC3TbgptCB in0VJoiKOp7ZHXanJOVFqmroqbwuaUOrpemo5HvApbAgJ9i8VY3gZHbygdBxwzhxk/LH z/LJytHYbxay7WwgtvUjFO0Pje869zNSxqPWfo2KBjOsQNIroDLWOgk7rihyAbCbmmGJ jJ8cKCYsFx2k5IUtVtLkr8INYB+sHkj4NvRwGOLRO+SCV+evm6m/x++s8iT66c7mo2S5 sx6ustIsby20+masWLmTcLOxHJJqmQ9eJiftWJUpXDDpSvobwIeJGkdl6ME5f6WBgMlF RzPQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=bJAJpPop; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id s12si25898qti.43.2020.04.09.15.02.01; Thu, 09 Apr 2020 15:02:17 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=bJAJpPop; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727302AbgDIU7p (ORCPT + 99 others); Thu, 9 Apr 2020 16:59:45 -0400 Received: from mail.kernel.org ([198.145.29.99]:46044 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726650AbgDIU7p (ORCPT ); Thu, 9 Apr 2020 16:59:45 -0400 Received: from mail-ua1-f51.google.com (mail-ua1-f51.google.com [209.85.222.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4F4F32082D; Thu, 9 Apr 2020 20:59:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586465984; bh=/zoh9Bel3OVki0JgUa51ErfZPh3PKGwN0xm71H6gVlE=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=bJAJpPoprDQK92N85fpzG0cgNvz0uW5e2GuCCkn3PP348hQvPcVPLpsxEGBwIDmOe 1QFW0xWU0pO2wsvNKS4EEfebkJ6KlsEo0+gmu78w3ZBZtXz+apwLu8pyuGYs1Ec2EH nWr6NEKRZpWA7DcYfEQAtGmxuemkzAn03uShNjvQ= Received: by mail-ua1-f51.google.com with SMTP id c7so504528uap.12; Thu, 09 Apr 2020 13:59:44 -0700 (PDT) X-Gm-Message-State: AGi0PuYgbkSjEZ1xaIwkV5+Rx1MebEdjXUnUff0lar/+AkG6xiJjPKuD DDqo9ts1XwqTwxEmXdS1D5o6Vvt8vQ34jgeghwQ= X-Received: by 2002:ab0:1e89:: with SMTP id o9mr829993uak.93.1586465983383; Thu, 09 Apr 2020 13:59:43 -0700 (PDT) MIME-Version: 1.0 References: <20200402000002.7442-1-mcgrof@kernel.org> <20200403081929.GC6887@ming.t460p> <0e753195-72fb-ce83-16a1-176f2c3cea6a@huawei.com> <20200407190004.GG11244@42.do-not-panic.com> In-Reply-To: <20200407190004.GG11244@42.do-not-panic.com> From: Luis Chamberlain Date: Thu, 9 Apr 2020 14:59:36 -0600 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [RFC 0/3] block: address blktrace use-after-free To: "yukuai (C)" Cc: Ming Lei , Jens Axboe , Al Viro , Greg Kroah-Hartman , Steven Rostedt , Ingo Molnar , Jan Kara , Nicolai Stange , Michal Hocko , linux-block@vger.kernel.org, Linux FS Devel , "linux-kernel@vger.kernel.org" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Apr 7, 2020 at 1:00 PM Luis Chamberlain wrote: > > On Tue, Apr 07, 2020 at 10:47:01AM +0800, yukuai (C) wrote: > > On 2020/4/3 16:19, Ming Lei wrote: > > > > > BTW, Yu Kuai posted one patch for this issue, looks that approach > > > is simpler: > > > > > > https://lore.kernel.org/linux-block/20200324132315.22133-1-yukuai3@hu= awei.com/ > > > > > > > > > > I think the issue might not be fixed with the patch seires. > > > > At first, I think there are two key points for the issure: > > 1. The final release of queue is delayed in a workqueue > > 2. The creation of 'q->debugfs_dir' might failed(only if 1 exist) > > And if we can fix any of the above problem, the UAF issue will be fixed= . > > (BTW, I did not come up with a good idea for problem 1, and my approach > > is for problem 2.) > > > > The third patch "block: avoid deferral of blk_release_queue() work" is > > not enough to fix problem 1: > > a. if CONFIG_DEBUG_KOBJECT_RELEASE is enable: > > static void kobject_release(struct kref *kref) > > { > > struct kobject *kobj =3D container_of(kref, struct kobject, kre= f); > > #ifdef CONFIG_DEBUG_KOBJECT_RELEASE > > unsigned long delay =3D HZ + HZ * (get_random_int() & 0x3); > > pr_info("kobject: '%s' (%p): %s, parent %p (delayed %ld)\n", > > =E2=94=8Akobject_name(kobj), kobj, __func__, kobj->pare= nt, delay); > > INIT_DELAYED_WORK(&kobj->release, kobject_delayed_cleanup); > > > > schedule_delayed_work(&kobj->release, delay); > > #else > > kobject_cleanup(kobj); > > #endif > > } > > b. when 'kobject_put' is called from blk_cleanup_queue, can we make sur= e > > it is the last reference? > > You are right, I think I know the fix for this now. Will run some more > tests. Yeap, we were just not refcounting during blktrace. I'll send a fix as part of the series. Luis