[permalink] [raw]

Subject: Re: [External] [PATCH 04/12] cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()

2024-04-25 04:57:12

by Jia Zhu

[permalink] [raw]

Subject: Re: [PATCH 10/12] cachefiles: Set object to close if ondemand_id < 0 in copen

在 2024/4/24 11:39, [email protected] 写道:
> From: Zizhi Wo <[email protected]>
>
> If copen is maliciously called in the user mode, it may delete the request
> corresponding to the random id. And the request may have not been read yet.
>
> Note that when the object is set to reopen, the open request will be done
> with the still reopen state in above case. As a result, the request
> corresponding to this object is always skipped in select_req function, so
> the read request is never completed and blocks other process.
>
> Fix this issue by simply set object to close if its id < 0 in copen.
>
> Signed-off-by: Zizhi Wo <[email protected]>
> Signed-off-by: Baokun Li <[email protected]>

Reviewed-by: Jia Zhu <[email protected]>

> ---
> fs/cachefiles/ondemand.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c
> index 7c2d43104120..673e7ad52041 100644
> --- a/fs/cachefiles/ondemand.c
> +++ b/fs/cachefiles/ondemand.c
> @@ -182,6 +182,7 @@ int cachefiles_ondemand_copen(struct cachefiles_cache *cache, char *args)
> xas_store(&xas, NULL);
> xa_unlock(&cache->reqs);
>
> + info = req->object->ondemand;
> /* fail OPEN request if copen format is invalid */
> ret = kstrtol(psize, 0, &size);
> if (ret) {
> @@ -201,7 +202,6 @@ int cachefiles_ondemand_copen(struct cachefiles_cache *cache, char *args)
> goto out;
> }
>
> - info = req->object->ondemand;
> spin_lock(&info->lock);
> /* The anonymous fd was closed before copen ? */
> if (info->ondemand_id == CACHEFILES_ONDEMAND_ID_CLOSED) {
> @@ -222,6 +222,11 @@ int cachefiles_ondemand_copen(struct cachefiles_cache *cache, char *args)
> wake_up_all(&cache->daemon_pollwq);
>
> out:
> + spin_lock(&info->lock);
> + /* Need to set object close to avoid reopen status continuing */
> + if (info->ondemand_id == CACHEFILES_ONDEMAND_ID_CLOSED)
> + cachefiles_ondemand_set_object_close(req->object);
> + spin_unlock(&info->lock);
> complete(&req->done);
> return ret;
> }

2024-04-25 05:15:53

by Jia Zhu

[permalink] [raw]

Subject: Re: [PATCH 12/12] cachefiles: make on-demand read killable

在 2024/4/24 11:39, [email protected] 写道:
> From: Baokun Li <[email protected]>
>
> Replacing wait_for_completion() with wait_for_completion_killable() in
> cachefiles_ondemand_send_req() allows us to kill processes that might
> trigger a hunk_task if the daemon is abnormal.
>
> But now only CACHEFILES_OP_READ is killable, because OP_CLOSE and OP_OPEN
> is initiated from kworker context and the signal is prohibited in these
> kworker.
>
> Note that when the req in xas changes, i.e. xas_load(&xas) != req, it
> means that a process will complete the current request soon, so wait
> again for the request to be completed.
>
> Suggested-by: Hou Tao <[email protected]>
> Signed-off-by: Baokun Li <[email protected]>

Reviewed-by: Jia Zhu <[email protected]>

> ---
> fs/cachefiles/ondemand.c | 21 +++++++++++++++++++--
> 1 file changed, 19 insertions(+), 2 deletions(-)
>
> diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c
> index 673e7ad52041..b766430f4abf 100644
> --- a/fs/cachefiles/ondemand.c
> +++ b/fs/cachefiles/ondemand.c
> @@ -525,8 +525,25 @@ static int cachefiles_ondemand_send_req(struct cachefiles_object *object,
> goto out;
>
> wake_up_all(&cache->daemon_pollwq);
> - wait_for_completion(&req->done);
> - ret = req->error;
> +wait:
> + ret = wait_for_completion_killable(&req->done);
> + if (!ret) {
> + ret = req->error;
> + } else {
> + xas_reset(&xas);
> + xas_lock(&xas);
> + if (xas_load(&xas) == req) {
> + xas_store(&xas, NULL);
> + ret = -EINTR;
> + }
> + xas_unlock(&xas);
> +
> + /* Someone will complete it soon. */
> + if (ret != -EINTR) {
> + cpu_relax();
> + goto wait;
> + }
> + }
> cachefiles_req_put(req);
> return ret;
> out: