From mboxrd@z Thu Jan 1 00:00:00 1970 From: Coly Li Subject: Re: [PATCH 3/5] bcache: fix refcount underflow in bcache_device_free() Date: Wed, 27 May 2020 10:40:50 +0800 Message-ID: <3588b887-ec5b-1306-1857-43f614472af9@suse.de> References: <20200526155928.32036-1-colyli@suse.de> <20200526155928.32036-4-colyli@suse.de> <34b826ff-0093-4427-f542-88c17abad934@kernel.dk> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <34b826ff-0093-4427-f542-88c17abad934@kernel.dk> Content-Language: en-US Sender: linux-block-owner@vger.kernel.org To: Jens Axboe Cc: linux-bcache@vger.kernel.org, linux-block@vger.kernel.org List-Id: linux-bcache@vger.kernel.org On 2020/5/27 01:23, Jens Axboe wrote: > On 5/26/20 9:59 AM, Coly Li wrote: >> The problematic code piece in bcache_device_free() is, >> >> 785 static void bcache_device_free(struct bcache_device *d) >> 786 { >> 787 struct gendisk *disk = d->disk; >> [snipped] >> 799 if (disk) { >> 800 if (disk->flags & GENHD_FL_UP) >> 801 del_gendisk(disk); >> 802 >> 803 if (disk->queue) >> 804 blk_cleanup_queue(disk->queue); >> 805 >> 806 ida_simple_remove(&bcache_device_idx, >> 807 first_minor_to_idx(disk->first_minor)); >> 808 put_disk(disk); >> 809 } >> [snipped] >> 816 } >> >> At line 808, put_disk(disk) may encounter kobject refcount of 'disk' >> being underflow. >> >> Here is how to reproduce the issue, >> - Attche the backing device to a cache device and do random write to >> make the cache being dirty. >> - Stop the bcache device while the cache device has dirty data of the >> backing device. >> - Only register the backing device back, NOT register cache device. >> - The bcache device node /dev/bcache0 won't show up, because backing >> device waits for the cache device shows up for the missing dirty >> data. >> - Now echo 1 into /sys/fs/bcache/pendings_cleanup, to stop the pending >> backing device. >> - After the pending backing device stopped, use 'dmesg' to check kernel >> message, a use-after-free warning from KASA reported the refcount of >> kobject linked to the 'disk' is underflow. >> >> The dropping refcount at line 808 in the above code piece is added by >> add_disk(d->disk) in bch_cached_dev_run(). But in the above condition >> the cache device is not registered, bch_cached_dev_run() has no chance >> to be called and the refcount is not added. The put_disk() for a non- >> added refcount of gendisk kobject triggers a underflow warning. >> >> This patch checks whether GENHD_FL_UP is set in disk->flags, if it is >> not set then the bcache device was not added, don't call put_disk() >> and the the underflow issue can be avoided. >> >> Signed-off-by: Coly Li >> --- >> drivers/md/bcache/super.c | 9 +++++++-- >> 1 file changed, 7 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c >> index 467149f3bcc5..c68d42730ca0 100644 >> --- a/drivers/md/bcache/super.c >> +++ b/drivers/md/bcache/super.c >> @@ -797,15 +797,20 @@ static void bcache_device_free(struct bcache_device *d) >> bcache_device_detach(d); >> >> if (disk) { >> - if (disk->flags & GENHD_FL_UP) >> + bool disk_added = false; >> + >> + if (disk->flags & GENHD_FL_UP) { >> + disk_added = true; >> del_gendisk(disk); >> + } > > This would be cleaner as: > > bool disk_added = (disk->flags & GENHD_FL_UP) != 0; > > if (disk_added) > del_gendisk(disk); > > and so on. > Sure, I improve it now in v2 series. Thanks. Coly Li From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A2B9C433E1 for ; Wed, 27 May 2020 02:41:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4448720787 for ; Wed, 27 May 2020 02:41:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726860AbgE0Ck7 (ORCPT ); Tue, 26 May 2020 22:40:59 -0400 Received: from mx2.suse.de ([195.135.220.15]:35340 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725601AbgE0Ck7 (ORCPT ); Tue, 26 May 2020 22:40:59 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 4CC63AE47; Wed, 27 May 2020 02:40:58 +0000 (UTC) Subject: Re: [PATCH 3/5] bcache: fix refcount underflow in bcache_device_free() To: Jens Axboe Cc: linux-bcache@vger.kernel.org, linux-block@vger.kernel.org References: <20200526155928.32036-1-colyli@suse.de> <20200526155928.32036-4-colyli@suse.de> <34b826ff-0093-4427-f542-88c17abad934@kernel.dk> From: Coly Li Autocrypt: addr=colyli@suse.de; keydata= mQINBFYX6S8BEAC9VSamb2aiMTQREFXK4K/W7nGnAinca7MRuFUD4JqWMJ9FakNRd/E0v30F qvZ2YWpidPjaIxHwu3u9tmLKqS+2vnP0k7PRHXBYbtZEMpy3kCzseNfdrNqwJ54A430BHf2S GMVRVENiScsnh4SnaYjFVvB8SrlhTsgVEXEBBma5Ktgq9YSoy5miatWmZvHLFTQgFMabCz/P j5/xzykrF6yHo0rHZtwzQzF8rriOplAFCECp/t05+OeHHxjSqSI0P/G79Ll+AJYLRRm9til/ K6yz/1hX5xMToIkYrshDJDrUc8DjEpISQQPhG19PzaUf3vFpmnSVYprcWfJWsa2wZyyjRFkf J51S82WfclafNC6N7eRXedpRpG6udUAYOA1YdtlyQRZa84EJvMzW96iSL1Gf+ZGtRuM3k49H 1wiWOjlANiJYSIWyzJjxAd/7Xtiy/s3PRKL9u9y25ftMLFa1IljiDG+mdY7LyAGfvdtIkanr iBpX4gWXd7lNQFLDJMfShfu+CTMCdRzCAQ9hIHPmBeZDJxKq721CyBiGAhRxDN+TYiaG/UWT 7IB7LL4zJrIe/xQ8HhRO+2NvT89o0LxEFKBGg39yjTMIrjbl2ZxY488+56UV4FclubrG+t16 r2KrandM7P5RjR+cuHhkKseim50Qsw0B+Eu33Hjry7YCihmGswARAQABtBhDb2x5IExpIDxj b2x5bGlAc3VzZS5kZT6JAlYEEwEIAEACGyMHCwkIBwMCAQYVCAIJCgsEFgIDAQIeAQIXgBYh BOo+RS/0+Uhgjej60Mc5B5Nrffj8BQJcR84dBQkY++fuAAoJEMc5B5Nrffj8ixcP/3KAKg1X EcoW4u/0z+Ton5rCyb/NpAww8MuRjNW82UBUac7yCi1y3OW7NtLjuBLw5SaVG5AArb7IF3U0 qTOobqfl5XHsT0o5wFHZaKUrnHb6y7V3SplsJWfkP3JmOooJsQB3z3K96ZTkFelsNb0ZaBRu gV+LA4MomhQ+D3BCDR1it1OX/tpvm2uaDF6s/8uFtcDEM9eQeqATN/QAJ49nvU/I8zDSY9rc 0x9mP0x+gH4RccbnoPu/rUG6Fm1ZpLrbb6NpaYBBJ/V1BC4lIOjnd24bsoQrQmnJn9dSr60X 1MY60XDszIyzRw7vbJcUn6ZzPNFDxFFT9diIb+wBp+DD8ZlD/hnVpl4f921ZbvfOSsXAJrKB 1hGY17FPwelp1sPcK2mDT+pfHEMV+OQdZzD2OCKtza/5IYismJJm3oVUYMogb5vDNAw9X2aP XgwUuG+FDEFPamFMUwIfzYHcePfqf0mMsaeSgtA/xTxzx/0MLjUJHl46Bc0uKDhv7QUyGz0j Ywgr2mHTvG+NWQ/mDeHNGkcnsnp3IY7koDHnN2xMFXzY4bn9m8ctqKo2roqjCzoxD/njoAhf KBzdybLHATqJG/yiZSbCxDA1n/J4FzPyZ0rNHUAJ/QndmmVspE9syFpFCKigvvyrzm016+k+ FJ59Q6RG4MSy/+J565Xj+DNY3/dCuQINBFYX6S8BEADZP+2cl4DRFaSaBms08W8/smc5T2CO YhAoygZn71rB7Djml2ZdvrLRjR8Qbn0Q/2L2gGUVc63pJnbrjlXSx2LfAFE0SlfYIJ11aFdF 9w7RvqWByQjDJor3Z0fWvPExplNgMvxpD0U0QrVT5dIGTx9hadejCl/ug09Lr6MPQn+a4+qs aRWwgCSHaIuDkH3zI1MJXiqXXFKUzJ/Fyx6R72rqiMPHH2nfwmMu6wOXAXb7+sXjZz5Po9GJ g2OcEc+rpUtKUJGyeQsnCDxUcqJXZDBi/GnhPCcraQuqiQ7EGWuJfjk51vaI/rW4bZkA9yEP B9rBYngbz7cQymUsfxuTT8OSlhxjP3l4ZIZFKIhDaQeZMj8pumBfEVUyiF6KVSfgfNQ/5PpM R4/pmGbRqrAAElhrRPbKQnCkGWDr8zG+AjN1KF6rHaFgAIO7TtZ+F28jq4reLkur0N5tQFww wFwxzROdeLHuZjL7eEtcnNnzSkXHczLkV4kQ3+vr/7Gm65mQfnVpg6JpwpVrbDYQeOFlxZ8+ GERY5Dag4KgKa/4cSZX2x/5+KkQx9wHwackw5gDCvAdZ+Q81nm6tRxEYBBiVDQZYqO73stgT ZyrkxykUbQIy8PI+g7XMDCMnPiDncQqgf96KR3cvw4wN8QrgA6xRo8xOc2C3X7jTMQUytCz9 0MyV1QARAQABiQI8BBgBCAAmAhsMFiEE6j5FL/T5SGCN6PrQxzkHk2t9+PwFAlxHziAFCRj7 5/EACgkQxzkHk2t9+PxgfA//cH5R1DvpJPwraTAl24SUcG9EWe+NXyqveApe05nk15zEuxxd e4zFEjo+xYZilSveLqYHrm/amvQhsQ6JLU+8N60DZHVcXbw1Eb8CEjM5oXdbcJpXh1/1BEwl 4phsQMkxOTns51bGDhTQkv4lsZKvNByB9NiiMkT43EOx14rjkhHw3rnqoI7ogu8OO7XWfKcL CbchjJ8t3c2XK1MUe056yPpNAT2XPNF2EEBPG2Y2F4vLgEbPv1EtpGUS1+JvmK3APxjXUl5z 6xrxCQDWM5AAtGfM/IswVjbZYSJYyH4BQKrShzMb0rWUjkpXvvjsjt8rEXpZEYJgX9jvCoxt oqjCKiVLpwje9WkEe9O9VxljmPvxAhVqJjX62S+TGp93iD+mvpCoHo3+CcvyRcilz+Ko8lfO hS9tYT0HDUiDLvpUyH1AR2xW9RGDevGfwGTpF0K6cLouqyZNdhlmNciX48tFUGjakRFsxRmX K0Jx4CEZubakJe+894sX6pvNFiI7qUUdB882i5GR3v9ijVPhaMr8oGuJ3kvwBIA8lvRBGVGn 9xvzkQ8Prpbqh30I4NMp8MjFdkwCN6znBKPHdjNTwE5PRZH0S9J0o67IEIvHfH0eAWAsgpTz +jwc7VKH7vkvgscUhq/v1/PEWCAqh9UHy7R/jiUxwzw/288OpgO+i+2l11Y= Message-ID: <3588b887-ec5b-1306-1857-43f614472af9@suse.de> Date: Wed, 27 May 2020 10:40:50 +0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Thunderbird/68.8.0 MIME-Version: 1.0 In-Reply-To: <34b826ff-0093-4427-f542-88c17abad934@kernel.dk> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-bcache-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-bcache@vger.kernel.org Message-ID: <20200527024050.8XCXmjJm5AnITYTd29fUbH-AY3oHDqTXYJAP8B9dGC8@z> On 2020/5/27 01:23, Jens Axboe wrote: > On 5/26/20 9:59 AM, Coly Li wrote: >> The problematic code piece in bcache_device_free() is, >> >> 785 static void bcache_device_free(struct bcache_device *d) >> 786 { >> 787 struct gendisk *disk = d->disk; >> [snipped] >> 799 if (disk) { >> 800 if (disk->flags & GENHD_FL_UP) >> 801 del_gendisk(disk); >> 802 >> 803 if (disk->queue) >> 804 blk_cleanup_queue(disk->queue); >> 805 >> 806 ida_simple_remove(&bcache_device_idx, >> 807 first_minor_to_idx(disk->first_minor)); >> 808 put_disk(disk); >> 809 } >> [snipped] >> 816 } >> >> At line 808, put_disk(disk) may encounter kobject refcount of 'disk' >> being underflow. >> >> Here is how to reproduce the issue, >> - Attche the backing device to a cache device and do random write to >> make the cache being dirty. >> - Stop the bcache device while the cache device has dirty data of the >> backing device. >> - Only register the backing device back, NOT register cache device. >> - The bcache device node /dev/bcache0 won't show up, because backing >> device waits for the cache device shows up for the missing dirty >> data. >> - Now echo 1 into /sys/fs/bcache/pendings_cleanup, to stop the pending >> backing device. >> - After the pending backing device stopped, use 'dmesg' to check kernel >> message, a use-after-free warning from KASA reported the refcount of >> kobject linked to the 'disk' is underflow. >> >> The dropping refcount at line 808 in the above code piece is added by >> add_disk(d->disk) in bch_cached_dev_run(). But in the above condition >> the cache device is not registered, bch_cached_dev_run() has no chance >> to be called and the refcount is not added. The put_disk() for a non- >> added refcount of gendisk kobject triggers a underflow warning. >> >> This patch checks whether GENHD_FL_UP is set in disk->flags, if it is >> not set then the bcache device was not added, don't call put_disk() >> and the the underflow issue can be avoided. >> >> Signed-off-by: Coly Li >> --- >> drivers/md/bcache/super.c | 9 +++++++-- >> 1 file changed, 7 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c >> index 467149f3bcc5..c68d42730ca0 100644 >> --- a/drivers/md/bcache/super.c >> +++ b/drivers/md/bcache/super.c >> @@ -797,15 +797,20 @@ static void bcache_device_free(struct bcache_device *d) >> bcache_device_detach(d); >> >> if (disk) { >> - if (disk->flags & GENHD_FL_UP) >> + bool disk_added = false; >> + >> + if (disk->flags & GENHD_FL_UP) { >> + disk_added = true; >> del_gendisk(disk); >> + } > > This would be cleaner as: > > bool disk_added = (disk->flags & GENHD_FL_UP) != 0; > > if (disk_added) > del_gendisk(disk); > > and so on. > Sure, I improve it now in v2 series. Thanks. Coly Li