linux-kernel - Re: [PATCH next] io-wq: fix use-after-free in io_wq_worker

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 26 Sep 2020 12:07:19 -0600
From:   Jens Axboe <axboe@...nel.dk>
To:     Hillf Danton <hdanton@...a.com>
Cc:     io-uring@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        viro@...iv.linux.org.uk,
        syzbot+45fa0a195b941764e0f0@...kaller.appspotmail.com,
        syzbot+9af99580130003da82b1@...kaller.appspotmail.com,
        Pavel Begunkov <asml.silence@...il.com>
Subject: Re: [PATCH next] io-wq: fix use-after-free in io_wq_worker_running

On 9/26/20 7:26 AM, Hillf Danton wrote:
> --- a/fs/io-wq.c
> +++ b/fs/io-wq.c
> @@ -200,7 +200,6 @@ static void io_worker_exit(struct io_wor
>  {
>  	struct io_wqe *wqe = worker->wqe;
>  	struct io_wqe_acct *acct = io_wqe_get_acct(wqe, worker);
> -	unsigned nr_workers;
>  
>  	/*
>  	 * If we're not at zero, someone else is holding a brief reference
> @@ -228,15 +227,11 @@ static void io_worker_exit(struct io_wor
>  		raw_spin_lock_irq(&wqe->lock);
>  	}
>  	acct->nr_workers--;
> -	nr_workers = wqe->acct[IO_WQ_ACCT_BOUND].nr_workers +
> -			wqe->acct[IO_WQ_ACCT_UNBOUND].nr_workers;
>  	raw_spin_unlock_irq(&wqe->lock);
>  
> -	/* all workers gone, wq exit can proceed */
> -	if (!nr_workers && refcount_dec_and_test(&wqe->wq->refs))
> -		complete(&wqe->wq->done);
> -
>  	kfree_rcu(worker, rcu);
> +	if (refcount_dec_and_test(&wqe->wq->refs))
> +		complete(&wqe->wq->done);
>  }

Nice, we came up with the same fix, thanks a lot for looking into this.
I pushed this one out for syzbot to test:

https://git.kernel.dk/cgit/linux-block/commit/?h=io_uring-5.9&id=41d5f92f60a61e264dafbada79175dad0bc60c5b

which is basically identical. I did consider the EXIT check as well, but
we don't really need it, so I'd prefer to leave that out of it.

I'll queue yours up.

-- 
Jens Axboe