Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <CALF+zOnmJ0=j8pEMikpxYgLrS10gVZiXfCjBhDz9Je0Qip7wnw@mail.gmail.com>
References: <CALF+zOnmJ0=j8pEMikpxYgLrS10gVZiXfCjBhDz9Je0Qip7wnw@mail.gmail.com> <163906878733.143852.5604115678965006622.stgit@warthog.procyon.org.uk> <CALF+zOnA2U6LjDTE8m2REDTMmFVnWkcBkn0ZJQRGULPUjeQW4Q@mail.gmail.com>
To:     David Wysochanski <dwysocha@redhat.com>
Cc:     dhowells@redhat.com, linux-cachefs <linux-cachefs@redhat.com>,
        linux-nfs <linux-nfs@vger.kernel.org>
Subject: [PATCH] fscache: Need to go round again after processing LRU_DISCARDING state
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <599330.1639410068.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: quoted-printable
Date:   Mon, 13 Dec 2021 15:41:08 +0000
Message-ID: <599331.1639410068@warthog.procyon.org.uk>
Precedence: bulk

David Wysochanski <dwysocha@redhat.com> wrote:

> > [  432.921382] BUG: KASAN: use-after-free in
> > fscache_unhash_cookie+0x9e/0x160 [fscache]^M

I think the patch below is the way to fix this.

David
---
fscache: Need to go round again after processing LRU_DISCARDING state

There's a race between the LRU discard and relinquishment actions.  In the
state machine, fscache_cookie_state_machine(), the ACTIVE state transits t=
o
the LRU_DISCARD state in preference to transiting to the RELINQUISHING or
WITHDRAWING states.

This should be fine, but the LRU_DISCARDING state just breaks out the
bottom of the function without going round again after transiting to the
QUIESCENT state.

However, if both LRU discard and relinquishment happen *before* the SM
runs, one of the queue events will get discarded, along with the ref that
would be associated with it.  The last ref is then discarded and the cooki=
e
is removed without completing the relinquishment process - leaving the
cookie hashed.

The fix is to make sure that the SM always goes back around after changing
the state.

Signed-off-by: David Howells <dhowells@redhat.com>
---

diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index d7e825d636e2..8d0769a5ee2b 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -755,7 +755,7 @@ static void fscache_cookie_state_machine(struct fscach=
e_cookie *cookie)
 		set_bit(FSCACHE_COOKIE_NO_DATA_TO_READ, &cookie->flags);
 		__fscache_set_cookie_state(cookie, FSCACHE_COOKIE_STATE_QUIESCENT);
 		wake =3D true;
-		break;
+		goto again_locked;
 =

 	case FSCACHE_COOKIE_STATE_DROPPED:
 		break;