public inbox for [email protected]
 help / color / mirror / Atom feed
* [PATCH v2] io-wq: Fix UAF when wakeup wqe in hash waitqueue
@ 2021-05-26  5:08 qiang.zhang
  2021-05-26 15:03 ` Jens Axboe
  0 siblings, 1 reply; 2+ messages in thread
From: qiang.zhang @ 2021-05-26  5:08 UTC (permalink / raw)
  To: axboe, asml.silence; +Cc: io-uring, linux-kernel

From: Zqiang <[email protected]>

BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650
Read of size 8 at addr ffff8880304250d8 by task iou-wrk-28796/28802

Call Trace:
 __dump_stack [inline]
 dump_stack+0x141/0x1d7
 print_address_description.constprop.0.cold+0x5b/0x2c6
 __kasan_report [inline]
 kasan_report.cold+0x7c/0xd8
 __wake_up_common+0x637/0x650
 __wake_up_common_lock+0xd0/0x130
 io_worker_handle_work+0x9dd/0x1790
 io_wqe_worker+0xb2a/0xd40
 ret_from_fork+0x1f/0x30

Allocated by task 28798:
 kzalloc_node [inline]
 io_wq_create+0x3c4/0xdd0
 io_init_wq_offload [inline]
 io_uring_alloc_task_context+0x1bf/0x6b0
 __io_uring_add_task_file+0x29a/0x3c0
 io_uring_add_task_file [inline]
 io_uring_install_fd [inline]
 io_uring_create [inline]
 io_uring_setup+0x209a/0x2bd0
 do_syscall_64+0x3a/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Freed by task 28798:
 kfree+0x106/0x2c0
 io_wq_destroy+0x182/0x380
 io_wq_put [inline]
 io_wq_put_and_exit+0x7a/0xa0
 io_uring_clean_tctx [inline]
 __io_uring_cancel+0x428/0x530
 io_uring_files_cancel
 do_exit+0x299/0x2a60
 do_group_exit+0x125/0x310
 get_signal+0x47f/0x2150
 arch_do_signal_or_restart+0x2a8/0x1eb0
 handle_signal_work[inline]
 exit_to_user_mode_loop [inline]
 exit_to_user_mode_prepare+0x171/0x280
 __syscall_exit_to_user_mode_work [inline]
 syscall_exit_to_user_mode+0x19/0x60
 do_syscall_64+0x47/0xb0
 entry_SYSCALL_64_after_hwframe

There are the following scenarios, hash waitqueue is shared by
io-wq1 and io-wq2. (note: wqe is worker)

io-wq1:worker2     | locks bit1
io-wq2:worker1     | waits bit1
io-wq1:worker3     | waits bit1

io-wq1:worker2     | completes all wqe bit1 work items
io-wq1:worker2     | drop bit1, exit

io-wq2:worker1     | locks bit1
io-wq1:worker3     | can not locks bit1, waits bit1 and exit
io-wq1             | exit and free io-wq1
io-wq2:worker1     | drops bit1
io-wq1:worker3     | be waked up, even though wqe is freed

After all iou-wrk belonging to io-wq1 have exited, remove wqe
form hash waitqueue, it is guaranteed that there will be no more
wqe belonging to io-wq1 in the hash waitqueue.

Reported-by: [email protected]
Suggested-by: Pavel Begunkov <[email protected]>
Signed-off-by: Zqiang <[email protected]>
---
 v1->v2:
 Modify commit information

 fs/io-wq.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/io-wq.c b/fs/io-wq.c
index 5361a9b4b47b..911a1274aabd 100644
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -1003,13 +1003,16 @@ static void io_wq_exit_workers(struct io_wq *wq)
 		struct io_wqe *wqe = wq->wqes[node];
 
 		io_wq_for_each_worker(wqe, io_wq_worker_wake, NULL);
-		spin_lock_irq(&wq->hash->wait.lock);
-		list_del_init(&wq->wqes[node]->wait.entry);
-		spin_unlock_irq(&wq->hash->wait.lock);
 	}
 	rcu_read_unlock();
 	io_worker_ref_put(wq);
 	wait_for_completion(&wq->worker_done);
+
+	for_each_node(node) {
+		spin_lock_irq(&wq->hash->wait.lock);
+		list_del_init(&wq->wqes[node]->wait.entry);
+		spin_unlock_irq(&wq->hash->wait.lock);
+	}
 	put_task_struct(wq->task);
 	wq->task = NULL;
 }
-- 
2.17.1


^ permalink raw reply related	[flat|nested] 2+ messages in thread

* Re: [PATCH v2] io-wq: Fix UAF when wakeup wqe in hash waitqueue
  2021-05-26  5:08 [PATCH v2] io-wq: Fix UAF when wakeup wqe in hash waitqueue qiang.zhang
@ 2021-05-26 15:03 ` Jens Axboe
  0 siblings, 0 replies; 2+ messages in thread
From: Jens Axboe @ 2021-05-26 15:03 UTC (permalink / raw)
  To: qiang.zhang, asml.silence; +Cc: io-uring, linux-kernel

On 5/25/21 11:08 PM, [email protected] wrote:
> From: Zqiang <[email protected]>
> 
> BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650
> Read of size 8 at addr ffff8880304250d8 by task iou-wrk-28796/28802
> 
> Call Trace:
>  __dump_stack [inline]
>  dump_stack+0x141/0x1d7
>  print_address_description.constprop.0.cold+0x5b/0x2c6
>  __kasan_report [inline]
>  kasan_report.cold+0x7c/0xd8
>  __wake_up_common+0x637/0x650
>  __wake_up_common_lock+0xd0/0x130
>  io_worker_handle_work+0x9dd/0x1790
>  io_wqe_worker+0xb2a/0xd40
>  ret_from_fork+0x1f/0x30
> 
> Allocated by task 28798:
>  kzalloc_node [inline]
>  io_wq_create+0x3c4/0xdd0
>  io_init_wq_offload [inline]
>  io_uring_alloc_task_context+0x1bf/0x6b0
>  __io_uring_add_task_file+0x29a/0x3c0
>  io_uring_add_task_file [inline]
>  io_uring_install_fd [inline]
>  io_uring_create [inline]
>  io_uring_setup+0x209a/0x2bd0
>  do_syscall_64+0x3a/0xb0
>  entry_SYSCALL_64_after_hwframe+0x44/0xae
> 
> Freed by task 28798:
>  kfree+0x106/0x2c0
>  io_wq_destroy+0x182/0x380
>  io_wq_put [inline]
>  io_wq_put_and_exit+0x7a/0xa0
>  io_uring_clean_tctx [inline]
>  __io_uring_cancel+0x428/0x530
>  io_uring_files_cancel
>  do_exit+0x299/0x2a60
>  do_group_exit+0x125/0x310
>  get_signal+0x47f/0x2150
>  arch_do_signal_or_restart+0x2a8/0x1eb0
>  handle_signal_work[inline]
>  exit_to_user_mode_loop [inline]
>  exit_to_user_mode_prepare+0x171/0x280
>  __syscall_exit_to_user_mode_work [inline]
>  syscall_exit_to_user_mode+0x19/0x60
>  do_syscall_64+0x47/0xb0
>  entry_SYSCALL_64_after_hwframe
> 
> There are the following scenarios, hash waitqueue is shared by
> io-wq1 and io-wq2. (note: wqe is worker)
> 
> io-wq1:worker2     | locks bit1
> io-wq2:worker1     | waits bit1
> io-wq1:worker3     | waits bit1
> 
> io-wq1:worker2     | completes all wqe bit1 work items
> io-wq1:worker2     | drop bit1, exit
> 
> io-wq2:worker1     | locks bit1
> io-wq1:worker3     | can not locks bit1, waits bit1 and exit
> io-wq1             | exit and free io-wq1
> io-wq2:worker1     | drops bit1
> io-wq1:worker3     | be waked up, even though wqe is freed
> 
> After all iou-wrk belonging to io-wq1 have exited, remove wqe
> form hash waitqueue, it is guaranteed that there will be no more
> wqe belonging to io-wq1 in the hash waitqueue.

Thanks, applied.

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-05-26 15:03 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-05-26  5:08 [PATCH v2] io-wq: Fix UAF when wakeup wqe in hash waitqueue qiang.zhang
2021-05-26 15:03 ` Jens Axboe

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox