From:   Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
To:     Yu Kuai <yukuai3@huawei.com>
CC:     "jack@suse.cz" <jack@suse.cz>, "tj@kernel.org" <tj@kernel.org>,
        "josef@toxicpanda.com" <josef@toxicpanda.com>,
        "axboe@kernel.dk" <axboe@kernel.dk>,
        "paolo.valente@linaro.org" <paolo.valente@linaro.org>,
        "cgroups@vger.kernel.org" <cgroups@vger.kernel.org>,
        "linux-block@vger.kernel.org" <linux-block@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "yukuai1@huaweicloud.com" <yukuai1@huaweicloud.com>,
        "yi.zhang@huawei.com" <yi.zhang@huawei.com>,
        "yangerkun@huawei.com" <yangerkun@huawei.com>
Subject: Re: [PATCH] block, bfq: fix uaf for bfqq in bic_set_bfqq()
Thread-Topic: [PATCH] block, bfq: fix uaf for bfqq in bic_set_bfqq()
Thread-Index: AQHZJzA0qxnUmy4g8k267BQ5n6rMJa6swduA
Date:   Tue, 24 Jan 2023 00:09:25 +0000
Message-ID: <20230124000925.pfosl6pfuhjyggbp@shindev>
References: <20230113094410.2907223-1-yukuai3@huawei.com>
In-Reply-To: <20230113094410.2907223-1-yukuai3@huawei.com>
Accept-Language: en-US
Content-Language: en-US
wdcipoutbound: EOP-TRUE
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?kfaMqeaASTXjS3Z2hz8rT7kJm9oqYRG7o4w0C+8r1XPxeBNlJZkE3cCLosW3?=
 =?us-ascii?Q?BuB8sziKgCzBXwrwJG6ITq3NU9+Y1yxDlPJdEmew4v+Un757r3GgFPZkOeSl?=
 =?us-ascii?Q?6UPdtBBk5MqiBCCNCJrVlCLdqE6fwuHs0jf1o7eRCNVGp53Q5+5BCf1Qq3OZ?=
 =?us-ascii?Q?b9n1ae7xssomXEP7IfjNsnB89IRjdRBK9N543Zem89QLuKfTgAMBDmM0dB68?=
 =?us-ascii?Q?QgAXVccBIR1bBo+ixAPBXiVqqwApgXI+5/hmsKv8kpoSGjUTaMpgk4Ad/swl?=
 =?us-ascii?Q?w/gRpIsdzI6E3Dx75K0bLX51635kE6TxjDzJLMsI0wlaWD9VybywUNYkDzQo?=
 =?us-ascii?Q?MiKE75VzUTRFoEIoulkls57INA8TP5GeG64f2nOkKJfJ75tiZxfJdxZ9KbN7?=
 =?us-ascii?Q?35f0Aeur4+uWoZchp/VwAoS17wG2Pek4nelxut8o4fpnhXb9FsCJ7lEQwnh2?=
 =?us-ascii?Q?Z9OnC4LJayszjf3EH42PAmUS/9hWgwGUc/W8Q+GbZWpdJgTlK2k3lAsl77oo?=
 =?us-ascii?Q?WwieYESQ4s4GMqNyhLvA6xGmQ1vNirY6MxkXkQBciMcdGNeZvO7zgQCimcc8?=
 =?us-ascii?Q?6/RGrLl3r59PQvpPEwMNxfrAhb8sqNGxzqzu183d45QVuwcKw17lc6zC7Pnw?=
 =?us-ascii?Q?cnvhxJdlWSTPX1oae1KBwISyAlklCHh9G3ueNPFGp0nRJBEbB42idcNPDaXJ?=
 =?us-ascii?Q?fjKbX4L+q6OV+uUHewfCBrEInZ0iC/PTvbCfnoDf/FT3CS9pTa3EorNy8uKf?=
 =?us-ascii?Q?22pC8eFI8BTvQfAav1upQYiSdYpzWsHbNsDBhQIKGwC7Ep45OKpSTAlz/wIy?=
 =?us-ascii?Q?9uuoDQGqu/nw8uN0EtQMKCEnaU1nWpTXN24P9W52g2FEQQxBJ5BnJhTJqiAo?=
 =?us-ascii?Q?idRLn1NdO7YOcJBs3pjtScmemQAHjwt6j1TebtSViU2oP+4SKsADXGpmKKzE?=
 =?us-ascii?Q?RHVYKkWfxJ3sNvnEzFvwctOnUWU2W1dyGZ16SZL+TkmS9elWDx9FRD3dtt2t?=
 =?us-ascii?Q?Dg/NU2VK4GTYq8mJAwc4ZUbfos4RC3ilAaPGB61SXvFTHw3ay+2vusMIi5mi?=
 =?us-ascii?Q?//j928viGbPinjmQicJ+zGG/47IVY/PfTBGSZeTe+aHP3FaN9nebCHWF8jij?=
 =?us-ascii?Q?qGlOpxAdeHQYFlSoI/PfGfO7pWXufKEBLDjeL79eVErRKWztW52Tncy/AOam?=
 =?us-ascii?Q?EMpSeXy3RXBF0A1l/EBiQBUttPei86xI2LoOmx2mrw0MN3C1MBg5okxJspeo?=
 =?us-ascii?Q?GBj/5z5nl0mXXK/JhceXAEAH2Xbn3U3Bqh3OcYkBEBebngD3Cx0mpvo0OYMi?=
 =?us-ascii?Q?KFIQiiaiw+XL2QdCldd575ZmDMVtHSkEEEylCSjZZryMO3iWD/52CEK3rSHz?=
 =?us-ascii?Q?3UDqYuQq+TrwVyLW2LJ332Bto9Vn8Ftig2NKB9fCiSAsc4fuxnw9+IQ3KRzY?=
 =?us-ascii?Q?qYsuaZysxeUw3cDyrTdM71f99ZsyNtHG+IaU5wrkAze0jJQV1U0VWTSSkyT0?=
 =?us-ascii?Q?2gfOcppCZMWA8eMai0mvVYTO8fxn+ZISKK3IC5uRP6UP4wH7kq75WJ2XM7kg?=
 =?us-ascii?Q?wqBNuSC4AV+8ATjZ8Ie6FS5PKSTHWqjbPIHjwGAMlwxru9vC6j1ZDg/ttaLf?=
 =?us-ascii?Q?yHG6Vdzu5CrY2dcGQYCU3q4=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <6C91E2F8801FB64D86D91C3DA08A2915@namprd04.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?65mHBDWMGIfJP7UfFRYFOfx0aWpZ8Srv8OcT1JoY37p7OT4oQNhOhk012NyJ?=
 =?us-ascii?Q?660mBhcvKD0xNSJwva9Z5DMo7MGB4hXY3jfOnVaWwgPCRPkAeFToFrMHfg9j?=
 =?us-ascii?Q?526hr7blFMhMDZS1nD0lZhPJOT31r6S5UmIGLgZ/wbiw4eTYsE3hemPG2tHp?=
 =?us-ascii?Q?SGrHX8K4NXclAYEDOwRMX8HVetJmN/Oq2AJQ1D5Qd/RwsvqorU25qHZv37PT?=
 =?us-ascii?Q?+BUlYFqB/5iBmDY+3X4CsmpeJz1/DiTBSh1Gs8cQKV0PHswxCLmnHgKe1l5r?=
 =?us-ascii?Q?TvPZHVyFg8vCg2+842OXbFRAnNT/g8k+CeNc897tGK2St+8Z3ON870pFqTJs?=
 =?us-ascii?Q?sDrLqQAx00d04xmdZEpIBj57dgkgiN7W7im+DFNhLDzvSUPlMEVNS+SXgrH/?=
 =?us-ascii?Q?fVUPr4MmXZ47N9ZABJF+lV7hY6CWfoWEhmV2UKWkJd+GLH9LT5kzxVCGzjQI?=
 =?us-ascii?Q?kcYh84XwP8vuRsfnQ8335gopAQv0Pw47arEfYe3yMEaxtGXb4DRtKVlyOGsX?=
 =?us-ascii?Q?TMIWhXRuBuKxKDXSHhDD8+pSAdeJlM/6SSreOk0R90d7KdI0Dxc/XijDi6lf?=
 =?us-ascii?Q?cKfNe6ASvXTyug1OgDQClkeJln/bYaCmWS+ASb8I/c1NcTTpMLGS3yYE43Q5?=
 =?us-ascii?Q?xdzCmmagVxJLP3043/jOGJtz496vq/BkY5IvGn0XneMNKPl4STviJ414iYLf?=
 =?us-ascii?Q?0k2x+owJoC01zDC/7d+VEoO4vMCaWSD1/fwnqCRn2ivxH4Jp6XFNzDGGa5Pd?=
 =?us-ascii?Q?W8ZoBF0e0/x6zzL4K6g6aqbZsZWU6JAzzEKrxFWQq1ZjjlB2USe3++RE1yf9?=
 =?us-ascii?Q?q/jKXG1UoDQ+D1z/fUFelsspk5WegG57IaxD1Ib6EcEOLnO8BdPzLBbd1Gks?=
 =?us-ascii?Q?Dpd8Fas/b0gTUbCfbvDaRG5cM4SWLRZIj83xAYzBmylWjBJc8pHAYdJkzVty?=
 =?us-ascii?Q?JFS8SypZnWLQzZ4okBbHaBxN2Uh+EWNK/cacBB8mGJAjbDdlnqpj1iRWkbRa?=
 =?us-ascii?Q?b2WT?=
X-OriginatorOrg: wdc.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DM8PR04MB8037.namprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6352303a-6f62-4f2a-458c-08dafd9f40ec
X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jan 2023 00:09:25.6574
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: b61c8803-16f3-4c35-9b17-6f65f441df86
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: HZNKIsbDfvHyHrUNOzeJ1YFmDpeWbSv9oRc7oNmlv8jwQjQeWlu2r7UqcMypCwUGNtgQzXF8PWtmhOoOi2wbohbTki4BM9vR3H4HX9FqPmg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR04MB7043
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Jan 13, 2023 / 17:44, Yu Kuai wrote:
> After commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'"=
),
> bic->bfqq will be accessed in bic_set_bfqq(), however, in some context
> bic->bfqq will be freed first, and bic_set_bfqq() is called with the free=
d
> bic->bfqq.
>=20
> Fix the problem by always freeing bfqq after bic_set_bfqq().
>=20
> Fixes: 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'")
> Reported-and-tested-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
> Signed-off-by: Yu Kuai <yukuai3@huawei.com>
> ---
>  block/bfq-cgroup.c  | 2 +-
>  block/bfq-iosched.c | 4 +++-
>  2 files changed, 4 insertions(+), 2 deletions(-)
>=20
> diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
> index a6e8da5f5cfd..feb13ac25557 100644
> --- a/block/bfq-cgroup.c
> +++ b/block/bfq-cgroup.c
> @@ -749,8 +749,8 @@ static void bfq_sync_bfqq_move(struct bfq_data *bfqd,
>  		 * old cgroup.
>  		 */
>  		bfq_put_cooperator(sync_bfqq);
> -		bfq_release_process_ref(bfqd, sync_bfqq);
>  		bic_set_bfqq(bic, NULL, true, act_idx);
> +		bfq_release_process_ref(bfqd, sync_bfqq);
>  	}
>  }
> =20

Yu, thanks for posting this fix, but it can not be applied to v6.2-rc5. The
hunk above looks different from the patch I tested. Could you take a look?

--=20
Shin'ichiro Kawasaki=