Skip to content

blktrace: fix debugfs use after free

Luis Chamberlain linux-block linux-fsdevel linux-mm lkml 8 versions – In review

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v7 Latest8 patches 17 repliesIn review
  2. v6 posting 2/26 patches 15 repliesSuperseded
  3. v6 posting 1/20 of 8 patches 0 repliesSuperseded
Earlier versions · 5
VersionPostedPatchesRepliesStatus
v57 patches16 repliesSuperseded
v45 patches10 repliesSuperseded
v36 patches26 repliesSuperseded
v210 patches46 repliesSuperseded
v15 patches47 repliesSuperseded

Patches in v7 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/8block: add docs for gendisk / request_queue refcount helpersblock/blk-core.c block/genhd.c+62 -10 replies
2/8block: clarify context for refcount increment helpersblock/blk-core.c block/genhd.c+8 -00 replies
3/8block: revert back to synchronous request_queue removalblock/blk-core.c block/blk-sysfs.c block/genhd.c +1 more+47 -230 replies
4/8blktrace: annotate required lock on do_blk_trace_setup()kernel/trace/blktrace.c+2 -01 reply
5/8loop: be paranoid on exit and prevent new additions / removalsdrivers/block/loop.c+4 -06 replies
6/8blktrace: fix debugfs use after freekernel/trace/blktrace.c+12 -63 replies
7/8blktrace: ensure our debugfs dir existskernel/trace/blktrace.c+12 -02 replies
8/8block: create the request_queue debugfs_dir on registrationblock/blk-core.c block/blk-mq-debugfs.c block/blk-sysfs.c +3 more+39 -484 replies

Reviews trailers per patch

All 8 patches have a Reviewed-by or Acked-by.

PatchChristoph HellwigBart Van AsscheMing Lei
1/8R-b R-b
2/8R-b R-b
3/8R-b R-b
4/8R-b
5/8R-b R-b
6/8R-b
7/8R-b R-b
8/8R-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 3 reviewers.

Read the v7 thread

Cover letter [PATCH v7 0/8] blktrace: fix debugfs use after free

Its been a fun ride, but all patch series come to an end. My hope is that this is it. The simplification of the fix is considerable now, with only a few lines of code and with no data structure changes.

We were only creating the debugfs_dir upon initialization only if you had CONFIG_BLK_DEBUG_FS for for make_request block drivers (multiqueue). That's where the UAF bug could happen. Folks liked the idea of open coding the debugfs initialization even if CONFIG_BLK_DEBUG_FS was disabled, given that debugfs code will simply ignore that code if debugfs is disabled, but to make the fix easier to backport, that shift is done now in another patch. Likewise, although we were only creating the debugfs_dir only for make_request block drivers (multiqueue), the same new additional patch also creates the debugfs_dir for request-based block drivers. That *begged* us to just rename the mutex to clarify its for the debugfs_dir, blktrace then just becomes its biggest user.

The only patches changed here is the last one from the last series, which actually fixed the UAF oops, and that one is now split in 3 patches, which makes a secondary fix much clearer.

I've waited a while to post these, to let 0-day give me its blessings, both for Linus' tree and linux-next. No issues have been found. I've also taken time to run blktests prior and after this series and I have found no regressions. In fact, I think I should just extend blktests with the break-blktrace tests, I'll do that later.

Luis Chamberlain (8):
block: add docs for gendisk / request_queue refcount helpers
block: clarify context for refcount increment helpers
block: revert back to synchronous request_queue removal
blktrace: annotate required lock on do_blk_trace_setup()
loop: be paranoid on exit and prevent new additions / removals
blktrace: fix debugfs use after free
blktrace: ensure our debugfs dir exists
block: create the request_queue debugfs_dir on registration

 block/blk-core.c        | 31 +++++++++++++----
 block/blk-mq-debugfs.c  |  5 ---
 block/blk-sysfs.c       | 52 ++++++++++++++++------------
 block/blk.h             |  2 --
 block/genhd.c           | 73 ++++++++++++++++++++++++++++++++++++++-
 drivers/block/loop.c    |  4 +++
 include/linux/blkdev.h  |  7 ++--
 kernel/trace/blktrace.c | 76 ++++++++++++++++++++++++-----------------
 8 files changed, 179 insertions(+), 71 deletions(-)
Signature · 1 line
2.26.2