Re: [PATCH v4 0/6] bdi: fix use-after-free for bdi device

["Theodore Y. Ts'o" <tytso@mit.edu>]

On Thu, Apr 09, 2020 at 09:28:07PM +0800, Yufen Yu wrote:
> ping

ping**2

Can this go in as a bugfix during this cycle?

    	       	    	   	  - Ted

> 
> On 2020/3/25 20:38, Yufen Yu wrote:
> > Hi, all
> > 
> > We have reported a use-after-free crash for bdi device in __blkg_prfill_rwstat().
> > The bug is caused by printing device kobj->name while the device and kobj->name
> > has been freed by bdi_unregister().
> > 
> > In fact, commit 68f23b8906 "memcg: fix a crash in wb_workfn when a device disappears"
> > has tried to address the issue, but the code is till somewhat racy after that commit.
> > 
> > In this patchset, we try to protect bdi->dev with spinlock and copy device name
> > into caller buffer, avoiding use-after-free.
> > 
> > V4:
> >    * Fix coding error in bdi_get_dev_name()
> >    * Write one patch for each broken caller
> > 
> > V3:
> >    https://www.spinics.net/lists/linux-block/msg51111.html
> >    Use spinlock to protect bdi->dev and copy device name into caller buffer
> > 
> > V2:
> >    https://www.spinics.net/lists/linux-fsdevel/msg163206.html
> >    Try to protect device lifetime with RCU.
> > 
> > V1:
> >    https://www.spinics.net/lists/linux-block/msg49693.html
> >    Add a new spinlock and copy kobj->name into caller buffer.
> >    Or using synchronize_rcu() to wait until reader complete.
> > 
> > Yufen Yu (6):
> >    bdi: use bdi_dev_name() to get device name
> >    bdi: protect bdi->dev with spinlock
> >    bfq: fix potential kernel crash when print error info
> >    memcg: fix crash in wb_workfn when bdi unregister
> >    blk-wbt: replace bdi_dev_name() with bdi_get_dev_name()
> >    blkcg: fix use-after-free for bdi->dev
> > 
> >   block/bfq-iosched.c              |  6 +++--
> >   block/blk-cgroup-rwstat.c        |  6 +++--
> >   block/blk-cgroup.c               | 19 +++++-----------
> >   block/blk-iocost.c               | 14 +++++++-----
> >   block/blk-iolatency.c            |  5 +++--
> >   block/blk-throttle.c             |  6 +++--
> >   fs/ceph/debugfs.c                |  2 +-
> >   fs/fs-writeback.c                |  4 +++-
> >   include/linux/backing-dev-defs.h |  1 +
> >   include/linux/backing-dev.h      | 26 ++++++++++++++++++++++
> >   include/linux/blk-cgroup.h       |  1 -
> >   include/trace/events/wbt.h       |  8 +++----
> >   include/trace/events/writeback.h | 38 ++++++++++++++------------------
> >   mm/backing-dev.c                 |  9 ++++++--
> >   14 files changed, 88 insertions(+), 57 deletions(-)
> >