Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
IronPort-SDR: MHyK65OtMj1t2efgeO3MqUtix1pAl9RFj0XX6rqaJzE1GhiFlnYjX80sSPCQ8fQmjBc6VgWYH5
 4j4WuU06gbxxueFvxEzp1dP0S8aW4ZJ44Gm8nVZExBMog9Mng+sIiPNwvyfQS+gFioG4VxMlHl
 q5rKCqPl9RqNT33GM2YkE/Dzblo0ofhFZqi3Xc5XfRdOLlLuxZsgYz33pXhSlbA1DHxH888bX2
 jRZa1Zu4K+BKvnelcCqJsvIE5gkVANnma98m5hdhlYaeh7l3Nmln/mhaAb87pXwFKU2td2dtCs
 8iU=
From:   Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
To:     John Garry <john.garry@huawei.com>
CC:     "hare@suse.de" <hare@suse.de>,
        "bvanassche@acm.org" <bvanassche@acm.org>,
        "ming.lei@redhat.com" <ming.lei@redhat.com>,
        "axboe@kernel.dk" <axboe@kernel.dk>, "hch@lst.de" <hch@lst.de>,
        "linux-block@vger.kernel.org" <linux-block@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "pragalla@codeaurora.org" <pragalla@codeaurora.org>,
        "kashyap.desai@broadcom.com" <kashyap.desai@broadcom.com>,
        "yuyufen@huawei.com" <yuyufen@huawei.com>
Subject: Re: [RFC PATCH v3 0/3] blk-mq: Avoid use-after-free for accessing old
 requests
Thread-Topic: [RFC PATCH v3 0/3] blk-mq: Avoid use-after-free for accessing
 old requests
Thread-Index: AQHXEdMJZXQrE52GNEm/GZZfpXu7C6qJnpgA
Date:   Thu, 18 Mar 2021 10:26:15 +0000
Message-ID: <20210318102614.5tatcdqmsphouydt@shindev.dhcp.fujisawa.hgst.com>
References: <1614957294-188540-1-git-send-email-john.garry@huawei.com>
In-Reply-To: <1614957294-188540-1-git-send-email-john.garry@huawei.com>
Accept-Language: en-US
Content-Language: en-US
wdcipoutbound: EOP-TRUE
Content-Type: text/plain; charset="us-ascii"
Content-ID: <062094E985769F458E6D88E7C2870FAF@namprd04.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: ec521c2a-e467-4ad5-aecb-08d8e9f8430a
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Mar 2021 10:26:15.7950
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: b61c8803-16f3-4c35-9b17-6f65f441df86
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: El88AgBwf+SDfG96blevH3CvOQlrFvAdaA/VG7xs19EH3QlAf21e7G3L9CFXHzeuOkfesO+v4eV2EYGVaKFCVimli9zPsq+e7ZQq4Y6SPkY=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR04MB4791
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Mar 05, 2021 / 23:14, John Garry wrote:
> This series aims to tackle the various UAF reports, like:
> [0] https://lore.kernel.org/linux-block/8376443a-ec1b-0cef-8244-ed584b96f=
a96@huawei.com/
> [1] https://lore.kernel.org/linux-block/5c3ac5af-ed81-11e4-fee3-f92175f14=
daf@acm.org/T/#m6c1ac11540522716f645d004e2a5a13c9f218908
> [2] https://lore.kernel.org/linux-block/04e2f9e8-79fa-f1cb-ab23-4a15bf3f6=
4cc@kernel.dk/
> [3] https://lore.kernel.org/linux-block/b859618aeac58bd9bb620d7ebdb24b90@=
codeaurora.org/
>=20
> Details are in the commit messages.
>=20
> The issue addressed in patch 1/3 is pretty easy to reproduce, 2+3/3 not s=
o
> much, and I had to add mdelays in the iters functions to recreate in
> sane timeframes.

I also observe the KASAN UAF in blk_mq_queue_tag_busy_iter during blktests =
run
with kernel version 5.12-rc2 and 5.12-rc3. When the test case block/005 is =
run
for HDDs behind SAS HBA (Broadcom 9400), the UAF message is always reported=
 and
it makes the test case fail. This failure was not observed with kernel v5.1=
1. I
suppose the failure was rare until v5.11, but changes between 5.11 and 5.12=
-rcX
made this failure happen more frequent.

I tried the patch 1/3 by John, and saw that it avoids the UAF message and t=
he
block/005 failure. I also tried the patch Bart suggested in this discussion
thread [1], and confirmed that it also avoids the UAF message. I appreciate
these fix work and discussion.

[1] https://marc.info/?l=3Dlinux-kernel&m=3D161559032606201&w=3D2

--=20
Best Regards,
Shin'ichiro Kawasaki=