From: Jens Axboe <[email protected]>
To: [email protected], [email protected]
Cc: [email protected], [email protected]
Subject: Re: [PATCH v2] io-wq: Fix UAF when wakeup wqe in hash waitqueue
Date: Wed, 26 May 2021 09:03:14 -0600 [thread overview]
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
On 5/25/21 11:08 PM, [email protected] wrote:
> From: Zqiang <[email protected]>
>
> BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650
> Read of size 8 at addr ffff8880304250d8 by task iou-wrk-28796/28802
>
> Call Trace:
> __dump_stack [inline]
> dump_stack+0x141/0x1d7
> print_address_description.constprop.0.cold+0x5b/0x2c6
> __kasan_report [inline]
> kasan_report.cold+0x7c/0xd8
> __wake_up_common+0x637/0x650
> __wake_up_common_lock+0xd0/0x130
> io_worker_handle_work+0x9dd/0x1790
> io_wqe_worker+0xb2a/0xd40
> ret_from_fork+0x1f/0x30
>
> Allocated by task 28798:
> kzalloc_node [inline]
> io_wq_create+0x3c4/0xdd0
> io_init_wq_offload [inline]
> io_uring_alloc_task_context+0x1bf/0x6b0
> __io_uring_add_task_file+0x29a/0x3c0
> io_uring_add_task_file [inline]
> io_uring_install_fd [inline]
> io_uring_create [inline]
> io_uring_setup+0x209a/0x2bd0
> do_syscall_64+0x3a/0xb0
> entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> Freed by task 28798:
> kfree+0x106/0x2c0
> io_wq_destroy+0x182/0x380
> io_wq_put [inline]
> io_wq_put_and_exit+0x7a/0xa0
> io_uring_clean_tctx [inline]
> __io_uring_cancel+0x428/0x530
> io_uring_files_cancel
> do_exit+0x299/0x2a60
> do_group_exit+0x125/0x310
> get_signal+0x47f/0x2150
> arch_do_signal_or_restart+0x2a8/0x1eb0
> handle_signal_work[inline]
> exit_to_user_mode_loop [inline]
> exit_to_user_mode_prepare+0x171/0x280
> __syscall_exit_to_user_mode_work [inline]
> syscall_exit_to_user_mode+0x19/0x60
> do_syscall_64+0x47/0xb0
> entry_SYSCALL_64_after_hwframe
>
> There are the following scenarios, hash waitqueue is shared by
> io-wq1 and io-wq2. (note: wqe is worker)
>
> io-wq1:worker2 | locks bit1
> io-wq2:worker1 | waits bit1
> io-wq1:worker3 | waits bit1
>
> io-wq1:worker2 | completes all wqe bit1 work items
> io-wq1:worker2 | drop bit1, exit
>
> io-wq2:worker1 | locks bit1
> io-wq1:worker3 | can not locks bit1, waits bit1 and exit
> io-wq1 | exit and free io-wq1
> io-wq2:worker1 | drops bit1
> io-wq1:worker3 | be waked up, even though wqe is freed
>
> After all iou-wrk belonging to io-wq1 have exited, remove wqe
> form hash waitqueue, it is guaranteed that there will be no more
> wqe belonging to io-wq1 in the hash waitqueue.
Thanks, applied.
--
Jens Axboe
prev parent reply other threads:[~2021-05-26 15:03 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-26 5:08 [PATCH v2] io-wq: Fix UAF when wakeup wqe in hash waitqueue qiang.zhang
2021-05-26 15:03 ` Jens Axboe [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox