Skip to content

K
Kernel

openeuler / Kernel
1 年多 前同步成功

通知 8
Star 0
Fork 0
K
Kernel
切换分支/标签
  1. 13 6月, 2023 2 次提交
  3. 09 6月, 2023 11 次提交
  5. 08 6月, 2023 21 次提交
  7. 07 6月, 2023 6 次提交
    • L
      block: fix order error in blk_release_queue · 6ff52765
      由 Li Nan 提交于 
      hulk inclusion
category: bugfix, https://gitee.com/openeuler/kernel/issues/I64SY5
bugzilla: 188093
CVE: NA

--------------------------------

blk_stat_free_callback() will check stats->callbacks, and wbt's callback
is freed in wbt_exit(), which is called by rq_qos_exit(). So move it in
front of blk_stat_free_callback().

Fixes: 015466fc61f4 ("block: fix null-pointer dereference in ioc_pd_init")
Signed-off-by: NLi Nan <linan122@huawei.com>
(cherry picked from commit e539db97)
      6ff52765
    • L
      block: fix null-pointer dereference in ioc_pd_init · 74874f22
      由 Li Nan 提交于 
      hulk inclusion
category: bugfix
bugzilla: 188044, https://gitee.com/openeuler/kernel/issues/I64SY5
CVE: NA

--------------------------------

Remove block device when iocost is initializing may cause
null-pointer dereference:

	CPU1				   CPU2
  ioc_qos_write
   blkcg_conf_open_bdev
    blkdev_get_no_open
     kobject_get_unless_zero
    blk_iocost_init
     rq_qos_add
  					blk_cleanup_queue
  					 rq_qos_exit
  					  q->rq_qos = rqos->next
  					   //iocost is removed from q->roqs
      blkcg_activate_policy
       pd_init_fn
        ioc_pd_init
  	 ioc = q_to_ioc(blkg->q)
 	  //can't find iocost and return null

Fix problem by moving rq_qos_exit() to blk_release_queue().
ioc_qos_write() get bd_device.kobj in blkcg_conf_open_bdev(), so
blk_release_queue() will not be activated until iocost initialization is
complited.

Fixes: 7caa4715 ("blkcg: implement blk-iocost")

Conflict:
	block/blk-core.c
	commit 4134b635 ("Revert "block: fix null-deref in percpu_ref_put"")
	changed context, which does not affect this patch.
Signed-off-by: NLi Nan <linan122@huawei.com>
(cherry picked from commit 2b9719ee)
      74874f22
    • Y
      blk-iocost: dispatch all throttled bio in ioc_pd_offline · b00f5f93
      由 Yu Kuai 提交于 
      hulk inclusion
category: bugfix
bugzilla: 188107, https://gitee.com/openeuler/kernel/issues/I665S2
CVE: NA

--------------------------------

Otherwise io will hang because timer is canceled. And make iocg->online
updated under both 'ioc->lock' and 'iocg->waitq.lock', so it can be
guaranteed that iocg will stay online while holding any lock.
Signed-off-by: NYu Kuai <yukuai3@huawei.com>
Signed-off-by: NLi Nan <linan122@huawei.com>
(cherry picked from commit bc184a0b)
      b00f5f93
    • Y
      blk-iocost: don't throttle bio if iocg is offlined · a413dc66
      由 Yu Kuai 提交于 
      hulk inclusion
category: bugfix
bugzilla: 188107, https://gitee.com/openeuler/kernel/issues/I665S2
CVE: NA

--------------------------------

bio will grab blkg reference, however, blkcg->online_pin is not grabbed,
hence cgroup can be removed after thread exit while bio is still in
progress. Bypass io in this suituation since it doesn't make sense to
throttle bio while cgroup is removed.
Signed-off-by: NYu Kuai <yukuai3@huawei.com>
Signed-off-by: NLi Nan <linan122@huawei.com>
(cherry picked from commit ebe0cb55)
      a413dc66
    • Y
      blk-iocost: track whether iocg is still online · eaf7154d
      由 Yu Kuai 提交于 
      hulk inclusion
category: bugfix
bugzilla: 188107, https://gitee.com/openeuler/kernel/issues/I665S2
CVE: NA

--------------------------------

blkcg_gq->online can't be used in iocost because it get cleared only after
all policies are offlined. This patch add a new field 'online' in iocg.
Signed-off-by: NYu Kuai <yukuai3@huawei.com>
Signed-off-by: NLi Nan <linan122@huawei.com>
(cherry picked from commit 3fcd5793)
      eaf7154d
    • L
      blk-iocost: fix UAF in ioc_pd_free · dd4ee77b
      由 Li Nan 提交于 
      hulk inclusion
category: bugfix
bugzilla: 188032, https://gitee.com/openeuler/kernel/issues/I64T3E
CVE: NA

--------------------------------

Our test found the following problem in kernel 5.10:

  BUG: KASAN: use-after-free in _raw_spin_lock_irqsave+0x71/0xe0
  Write of size 4 at addr ffff8881432000e0 by task swapper/4/0
  ...
  Call Trace:
   <IRQ>
   dump_stack+0x9c/0xd3
   print_address_description.constprop.0+0x19/0x170
   __kasan_report.cold+0x6c/0x84
   kasan_report+0x3a/0x50
   check_memory_region+0xfd/0x1f0
   _raw_spin_lock_irqsave+0x71/0xe0
   ioc_pd_free+0x9d/0x250
   blkg_free.part.0+0x80/0x100
   __blkg_release+0xf3/0x1c0
   rcu_do_batch+0x292/0x700
   rcu_core+0x270/0x2d0
   __do_softirq+0xfd/0x402
    </IRQ>
   asm_call_irq_on_stack+0x12/0x20
   do_softirq_own_stack+0x37/0x50
   irq_exit_rcu+0x134/0x1a0
   sysvec_apic_timer_interrupt+0x36/0x80
   asm_sysvec_apic_timer_interrupt+0x12/0x20

   Freed by task 57:
   kfree+0xba/0x680
   rq_qos_exit+0x5a/0x80
   blk_cleanup_queue+0xce/0x1a0
   virtblk_remove+0x77/0x130 [virtio_blk]
   virtio_dev_remove+0x56/0xe0
   __device_release_driver+0x2ba/0x450
   device_release_driver+0x29/0x40
   bus_remove_device+0x1d8/0x2c0
   device_del+0x333/0x7e0
   device_unregister+0x27/0x90
   unregister_virtio_device+0x22/0x40
   virtio_pci_remove+0x53/0xb0
   pci_device_remove+0x7a/0x130
   __device_release_driver+0x2ba/0x450
   device_release_driver+0x29/0x40
   pci_stop_bus_device+0xcf/0x100
   pci_stop_and_remove_bus_device+0x16/0x20
   disable_slot+0xa1/0x110
   acpiphp_disable_and_eject_slot+0x35/0xe0
   hotplug_event+0x1b8/0x3c0
   acpiphp_hotplug_notify+0x37/0x70
   acpi_device_hotplug+0xee/0x320
   acpi_hotplug_work_fn+0x69/0x80
   process_one_work+0x3c5/0x730
   worker_thread+0x93/0x650
   kthread+0x1ba/0x210
   ret_from_fork+0x22/0x30

It happened as follow:

        T1            T2              T3	    T4
  //delete device
  del_gendisk
   bdi_unregister
    bdi_remove_from_list
     synchronize_rcu_expedited

               //rmdir cgroup
               blkcg_destroy_blkgs
                blkg_destroy
                 percpu_ref_kill
                  blkg_release
                   call_rcu
				blk_cleanup_queue
       			          rq_qos_exit
			           ioc_rqos_exit
			            kfree(ioc)
					    __blkg_release
                           		     blkg_free
                           		      blkg_free_workfn
                           		       pd_free_fn
                           		        ioc_pd_free
						 spin_lock_irqsave
						  ->ioc is freed

Fix the problem by moving the operation on ioc in ioc_pd_free() to
ioc_pd_offline(), and just free resource in ioc_pd_free() like iolatency
and throttle.

Fixes: 7caa4715 ("blkcg: implement blk-iocost")
Signed-off-by: NLi Nan <linan122@huawei.com>
(cherry picked from commit 4c2d16fb)
      dd4ee77b