[PATCH 0/9 v7] bfq: Avoid use-after-free when moving processes between cgroups

Jan Kara
2022-04-01T10:28:06Z

Hello,

here is the seventh version of my patches to fix use-after-free issues in BFQ
when processes with merged queues get moved to different cgroups. Kuai has
confirmed that patches now fix all the issues his reproducer was able to
trigger so I've just added some tags, codewise this is the same as v6. Paolo,
can you please check whether the patches look good to you so that Jens can
merge them? Thanks!

Changes since v6:
* Added some Tested-by, Fixes, and CC tags

Changes since v5:
* Added handling of situation when bio is submitted for a cgroup that has
already went through bfq_pd_offline()
* Convert bfq to avoid using deprecated __bio_blkcg() and thus fix possible
races when returned cgroup can change while bfq is working with a request

Changes since v4:
* Even more aggressive splitting of merged bfq queues to avoid problems with
long merge chains.

Changes since v3:
* Changed handling of bfq group move to handle the case when target of the
merge has moved.

Changes since v2:
* Improved handling of bfq queue splitting on move between cgroups
* Removed broken change to bfq_put_cooperator()

Changes since v1:
* Added fix for bfq_put_cooperator()
* Added fix to handle move between cgroups in bfq_merge_bio()

Honza
Previous versions:
Link: http://lore.kernel.org/r/20211223171425.3551-1-jack@suse.cz # v1
Link: http://lore.kernel.org/r/20220105143037.20542-1-jack@suse.cz # v2
Link: http://lore.kernel.org/r/20220112113529.6355-1-jack@suse.cz # v3
Link: http://lore.kernel.org/r/20220114164215.28972-1-jack@suse.cz # v4
Link: http://lore.kernel.org/r/20220121105503.14069-1-jack@suse.cz # v5
Link: http://lore.kernel.org/r/20220330123438.32719-1-jack@suse.cz # v6