linux-kernel - Re: [PATCH BUGFIX V2 1/1] block, bfq: deschedule empty bfq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <89dde326-fc76-10cc-5ec9-ec5fd4dae4ac@applied-asynchrony.com>
Date:   Fri, 15 Nov 2019 19:32:50 +0100
From:   Holger Hoffstätte <holger@...lied-asynchrony.com>
To:     Paolo Valente <paolo.valente@...aro.org>,
        Jens Axboe <axboe@...nel.dk>
Cc:     linux-block@...r.kernel.org, linux-kernel@...r.kernel.org,
        ulf.hansson@...aro.org, linus.walleij@...aro.org,
        bfq-iosched@...glegroups.com, oleksandr@...alenko.name,
        tschubert@...h.org, patdung100@...il.com, cevich@...hat.com
Subject: Re: [PATCH BUGFIX V2 1/1] block, bfq: deschedule empty bfq_queues not
 referred by any process

On 11/14/19 10:33 AM, Paolo Valente wrote:
> Since commit 3726112ec731 ("block, bfq: re-schedule empty queues if
> they deserve I/O plugging"), to prevent the service guarantees of a
> bfq_queue from being violated, the bfq_queue may be left busy, i.e.,
> scheduled for service, even if empty (see comments in
> __bfq_bfqq_expire() for details). But, if no process will send
> requests to the bfq_queue any longer, then there is no point in
> keeping the bfq_queue scheduled for service.
> 
> In addition, keeping the bfq_queue scheduled for service, but with no
> process reference any longer, may cause the bfq_queue to be freed when
> descheduled from service. But this is assumed to never happen, and
> causes a UAF if it happens. This, in turn, caused crashes [1, 2].
> 
> This commit fixes this issue by descheduling an empty bfq_queue when
> it remains with not process reference.
> 
> [1] https://bugzilla.redhat.com/show_bug.cgi?id=1767539
> [2] https://bugzilla.kernel.org/show_bug.cgi?id=205447
> 
> Fixes: 3726112ec731 ("block, bfq: re-schedule empty queues if they deserve I/O plugging")
> Reported-by: Chris Evich <cevich@...hat.com>
> Reported-by: Patrick Dung <patdung100@...il.com>
> Reported-by: Thorsten Schubert <tschubert@...h.org>
> Tested-by: Thorsten Schubert <tschubert@...h.org>
> Tested-by: Oleksandr Natalenko <oleksandr@...alenko.name>
> Signed-off-by: Paolo Valente <paolo.valente@...aro.org>

Jens,

can you please also tag this for stable-5.3 before the next push?
The original problem was found on 5.3 after all, and hoping for the
stable-bot to pick it up automagically is a bit unreliable.

Thanks,
Holger