[PATCH v2] io-wq: Fix UAF when wakeup wqe in hash waitqueue

[PATCH v2] io-wq: Fix UAF when wakeup wqe in hash waitqueue

[qiang.zhang]

From: Zqiang <qiang.zhang@windriver.com>

BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650
Read of size 8 at addr ffff8880304250d8 by task iou-wrk-28796/28802

Call Trace:
 __dump_stack [inline]
 dump_stack+0x141/0x1d7
 print_address_description.constprop.0.cold+0x5b/0x2c6
 __kasan_report [inline]
 kasan_report.cold+0x7c/0xd8
 __wake_up_common+0x637/0x650
 __wake_up_common_lock+0xd0/0x130
 io_worker_handle_work+0x9dd/0x1790
 io_wqe_worker+0xb2a/0xd40
 ret_from_fork+0x1f/0x30

Allocated by task 28798:
 kzalloc_node [inline]
 io_wq_create+0x3c4/0xdd0
 io_init_wq_offload [inline]
 io_uring_alloc_task_context+0x1bf/0x6b0
 __io_uring_add_task_file+0x29a/0x3c0
 io_uring_add_task_file [inline]
 io_uring_install_fd [inline]
 io_uring_create [inline]
 io_uring_setup+0x209a/0x2bd0
 do_syscall_64+0x3a/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Freed by task 28798:
 kfree+0x106/0x2c0
 io_wq_destroy+0x182/0x380
 io_wq_put [inline]
 io_wq_put_and_exit+0x7a/0xa0
 io_uring_clean_tctx [inline]
 __io_uring_cancel+0x428/0x530
 io_uring_files_cancel
 do_exit+0x299/0x2a60
 do_group_exit+0x125/0x310
 get_signal+0x47f/0x2150
 arch_do_signal_or_restart+0x2a8/0x1eb0
 handle_signal_work[inline]
 exit_to_user_mode_loop [inline]
 exit_to_user_mode_prepare+0x171/0x280
 __syscall_exit_to_user_mode_work [inline]
 syscall_exit_to_user_mode+0x19/0x60
 do_syscall_64+0x47/0xb0
 entry_SYSCALL_64_after_hwframe

There are the following scenarios, hash waitqueue is shared by
io-wq1 and io-wq2. (note: wqe is worker)

io-wq1:worker2     | locks bit1
io-wq2:worker1     | waits bit1
io-wq1:worker3     | waits bit1

io-wq1:worker2     | completes all wqe bit1 work items
io-wq1:worker2     | drop bit1, exit

io-wq2:worker1     | locks bit1
io-wq1:worker3     | can not locks bit1, waits bit1 and exit
io-wq1             | exit and free io-wq1
io-wq2:worker1     | drops bit1
io-wq1:worker3     | be waked up, even though wqe is freed

After all iou-wrk belonging to io-wq1 have exited, remove wqe
form hash waitqueue, it is guaranteed that there will be no more
wqe belonging to io-wq1 in the hash waitqueue.

Reported-by: syzbot+6cb11ade52aa17095297@syzkaller.appspotmail.com
Suggested-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Zqiang <qiang.zhang@windriver.com>
---
 v1->v2:
 Modify commit information

 fs/io-wq.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/io-wq.c b/fs/io-wq.c
index 5361a9b4b47b..911a1274aabd 100644
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -1003,13 +1003,16 @@ static void io_wq_exit_workers(struct io_wq *wq)
 		struct io_wqe *wqe = wq->wqes[node];
 
 		io_wq_for_each_worker(wqe, io_wq_worker_wake, NULL);
-		spin_lock_irq(&wq->hash->wait.lock);
-		list_del_init(&wq->wqes[node]->wait.entry);
-		spin_unlock_irq(&wq->hash->wait.lock);
 	}
 	rcu_read_unlock();
 	io_worker_ref_put(wq);
 	wait_for_completion(&wq->worker_done);
+
+	for_each_node(node) {
+		spin_lock_irq(&wq->hash->wait.lock);
+		list_del_init(&wq->wqes[node]->wait.entry);
+		spin_unlock_irq(&wq->hash->wait.lock);
+	}
 	put_task_struct(wq->task);
 	wq->task = NULL;
 }
-- 
2.17.1

Re: [PATCH v2] io-wq: Fix UAF when wakeup wqe in hash waitqueue

[Jens Axboe]

On 5/25/21 11:08 PM, qiang.zhang@windriver.com wrote:
> From: Zqiang <qiang.zhang@windriver.com>
> 
> BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650
> Read of size 8 at addr ffff8880304250d8 by task iou-wrk-28796/28802
> 
> Call Trace:
>  __dump_stack [inline]
>  dump_stack+0x141/0x1d7
>  print_address_description.constprop.0.cold+0x5b/0x2c6
>  __kasan_report [inline]
>  kasan_report.cold+0x7c/0xd8
>  __wake_up_common+0x637/0x650
>  __wake_up_common_lock+0xd0/0x130
>  io_worker_handle_work+0x9dd/0x1790
>  io_wqe_worker+0xb2a/0xd40
>  ret_from_fork+0x1f/0x30
> 
> Allocated by task 28798:
>  kzalloc_node [inline]
>  io_wq_create+0x3c4/0xdd0
>  io_init_wq_offload [inline]
>  io_uring_alloc_task_context+0x1bf/0x6b0
>  __io_uring_add_task_file+0x29a/0x3c0
>  io_uring_add_task_file [inline]
>  io_uring_install_fd [inline]
>  io_uring_create [inline]
>  io_uring_setup+0x209a/0x2bd0
>  do_syscall_64+0x3a/0xb0
>  entry_SYSCALL_64_after_hwframe+0x44/0xae
> 
> Freed by task 28798:
>  kfree+0x106/0x2c0
>  io_wq_destroy+0x182/0x380
>  io_wq_put [inline]
>  io_wq_put_and_exit+0x7a/0xa0
>  io_uring_clean_tctx [inline]
>  __io_uring_cancel+0x428/0x530
>  io_uring_files_cancel
>  do_exit+0x299/0x2a60
>  do_group_exit+0x125/0x310
>  get_signal+0x47f/0x2150
>  arch_do_signal_or_restart+0x2a8/0x1eb0
>  handle_signal_work[inline]
>  exit_to_user_mode_loop [inline]
>  exit_to_user_mode_prepare+0x171/0x280
>  __syscall_exit_to_user_mode_work [inline]
>  syscall_exit_to_user_mode+0x19/0x60
>  do_syscall_64+0x47/0xb0
>  entry_SYSCALL_64_after_hwframe
> 
> There are the following scenarios, hash waitqueue is shared by
> io-wq1 and io-wq2. (note: wqe is worker)
> 
> io-wq1:worker2     | locks bit1
> io-wq2:worker1     | waits bit1
> io-wq1:worker3     | waits bit1
> 
> io-wq1:worker2     | completes all wqe bit1 work items
> io-wq1:worker2     | drop bit1, exit
> 
> io-wq2:worker1     | locks bit1
> io-wq1:worker3     | can not locks bit1, waits bit1 and exit
> io-wq1             | exit and free io-wq1
> io-wq2:worker1     | drops bit1
> io-wq1:worker3     | be waked up, even though wqe is freed
> 
> After all iou-wrk belonging to io-wq1 have exited, remove wqe
> form hash waitqueue, it is guaranteed that there will be no more
> wqe belonging to io-wq1 in the hash waitqueue.

Thanks, applied.

-- 
Jens Axboe