Re: [RFC PATCH v5 1/5] blk-iocost: add BPF struct_ops cost model support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] block: double put of BPF model refcount causes UAF
--

commit 2eda7a01a5e699f80e0a5c6532ed592350e8c63c
Author: Tao Cui <cuitao@kylinos.cn>

blk-iocost: add BPF struct_ops cost model support

This commit adds the iocost_model_ops struct_ops to allow a bound BPF
model to replace the builtin linear model on a device.

> diff --git a/block/blk-iocost.c b/block/blk-iocost.c
> index 2745bffcd5eef..c4e8c8e09bf23 100644
> --- a/block/blk-iocost.c
> +++ b/block/blk-iocost.c
[ ... ]
> @@ -3550,19 +3695,42 @@ static ssize_t ioc_cost_model_write(struct kernfs_open_file *of, char *input,
[ ... ]
>  unlock:
>  	spin_unlock_irq(&ioc->lock);
>  
> +	/* resolve the name outside ioc->lock; see ioc_bpf_model_prepare() */
> +	if (!ret) {
> +		const struct iocost_model_ops *new, *old;
> +
> +		new = ioc_bpf_model_prepare(bpf_model);
> +		if (IS_ERR(new)) {
> +			ret = PTR_ERR(new);
> +		} else {
> +			spin_lock_irq(&ioc->lock);
> +			if (user) {
> +				memcpy(ioc->params.i_lcoefs, u, sizeof(u));
> +				ioc->user_cost_model = true;
> +			} else {
> +				ioc->user_cost_model = false;
> +			}
> +			ioc_refresh_params(ioc, true);
> +			old = ioc_bpf_model_commit(ioc, new);
> +			spin_unlock_irq(&ioc->lock);
> +			if (IS_ENABLED(CONFIG_BLK_CGROUP_IOCOST_BPF) && old) {
> +				iocost_bpf_model_put(old);
> +				/*
> +				 * a racing writer may have committed the same
> +				 * model after we resolved it; our resolved
> +				 * reference is then redundant
> +				 */
> +				if (old == new)
> +					iocost_bpf_model_put(new);

[Severity: Critical]
In ioc_cost_model_write(), if a user writes the same model name twice, or
writes parameter updates to an already bound model, ioc_bpf_model_commit()
will return the same pointer as new (so old == new).

Since we only acquired one new reference in ioc_bpf_model_prepare(), calling
iocost_bpf_model_put() on both old and new will drop two references from the
same object.

Can this underflow the reference count and cause a use-after-free on the IO
submission path in calc_cost()?

> +			}
> +		}
> +	}
> +
>  	blk_mq_unquiesce_queue(q);
>  	blk_mq_unfreeze_queue(q, memflags);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918031751.1255420-1-cui.tao@linux.dev?part=1