Re: [PATCH V4 0/4] blk-mq: fix request UAF related with iterating over tagset requests

Ming Lei
2021-05-04T07:29:42Z

On Thu, Apr 29, 2021 at 10:34:54AM +0800, Ming Lei wrote:
> Hi Jens,
>
> This patchset fixes the request UAF issue by one simple approach,
> without clearing ->rqs[] in fast path.
>
> 1) grab request's ref before calling ->fn in blk_mq_tagset_busy_iter,
> and release it after calling ->fn, so ->fn won't be called for one
> request if its queue is frozen, done in 2st patch
>
> 2) clearing any stale request referred in ->rqs[] before freeing the
> request pool, one per-tags spinlock is added for protecting
> grabbing request ref vs. clearing ->rqs[tag], so UAF by refcount_inc_not_zero
> in bt_tags_iter() is avoided, done in 3rd patch.
>
>
> V4:
> - remove hctx->fq-flush_rq from tags->rqs[] before freeing hw queue,
> patch 4/4 is added, which is based on David's patch.

Hello Jens,

Any chance to merge the patch to 5.13 if you are fine?

Thanks,
Ming