[PATCH] ublk: retain server PID generation across timeout

[PATCH] ublk: retain server PID generation across timeout

[Sung Byeongchan]

The UBLK char opener is recorded as a bare numeric tgid. A child can
retain the char file after the opener exits, delaying final release while
allowing the numeric PID to be reused.

START currently resolves the supplied number only long enough to compare
it with the stored number. The request timeout later performs another
numeric lookup and can therefore send SIGKILL to an unrelated task that
acquired the opener's PID.

Retain a reference to the opener's struct pid, compare START against that
object, use the same generation in the timeout callback, and drop the
reference after release work drains and resets the device.

On the exact target, a local production-path fixture reproduced SIGKILL
to an independent reused-PID victim in three of three baseline boots. The
fixed kernel rejected the mismatched generation in three of three boots.
Normal I/O, near-negative rejection, cleanup and following-valid recovery
each passed in matched baseline and fixed lanes.

The demonstrated impact is cross-principal process termination after UBLK
delegation. Memory corruption, information disclosure, privilege
escalation, RCE and LPE were not demonstrated.

Fixes: dd7a8507319e ("ublk: look up ublk task via its pid in timeout handler")
Assisted-by: OpenAI Codex

Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
---
 drivers/block/ublk_drv.c |   16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 3d322fa1bc831..deb0a179a88ad 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -11,6 +11,7 @@
  */
 #include <linux/module.h>
 #include <linux/moduleparam.h>
+#include <linux/pid.h>
 #include <linux/sched.h>
 #include <linux/fs.h>
 #include <linux/pagemap.h>
@@ -345,6 +346,7 @@ struct ublk_device {
 	 */
 	bool canceling;
 	pid_t 	ublksrv_tgid;
+	struct pid	*ublksrv_pid;
 	struct delayed_work	exit_work;
 	struct work_struct	partition_scan_work;
 
@@ -2130,18 +2132,16 @@ static void ublk_queue_cmd_list(struct ublk_io *io, struct rq_list *l)
 static enum blk_eh_timer_return ublk_timeout(struct request *rq)
 {
 	struct ublk_queue *ubq = rq->mq_hctx->driver_data;
-	pid_t tgid = ubq->dev->ublksrv_tgid;
+	struct pid *pid = ubq->dev->ublksrv_pid;
 	struct task_struct *p;
-	struct pid *pid;
 
 	if (!(ubq->flags & UBLK_F_UNPRIVILEGED_DEV))
 		return BLK_EH_RESET_TIMER;
 
-	if (unlikely(!tgid))
+	if (unlikely(!pid))
 		return BLK_EH_RESET_TIMER;
 
 	rcu_read_lock();
-	pid = find_vpid(tgid);
 	p = pid_task(pid, PIDTYPE_PID);
 	if (p)
 		send_sig(SIGKILL, p, 0);
@@ -2410,6 +2410,7 @@ static int ublk_ch_open(struct inode *inode, struct file *filp)
 		return -EBUSY;
 	filp->private_data = ub;
 	ub->ublksrv_tgid = current->tgid;
+	ub->ublksrv_pid = get_pid(task_tgid(current));
 	mutex_lock(&ub->cancel_mutex);
 	ub->ch_file = filp;
 	mutex_unlock(&ub->cancel_mutex);
@@ -2633,6 +2634,7 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
 	ublk_reset_ch_dev(ub);
 	mutex_unlock(&ub->mutex);
 	ublk_put_disk(disk);
+	put_pid(xchg(&ub->ublksrv_pid, NULL));
 	clear_bit(UB_STATE_OPEN, &ub->state);
 
 	/* put the reference grabbed in ublk_ch_release() */
@@ -4530,11 +4532,13 @@ static struct ublk_device *ublk_get_device_from_id(int idx)
 
 static bool ublk_validate_user_pid(struct ublk_device *ub, pid_t ublksrv_pid)
 {
+	bool valid;
+
 	rcu_read_lock();
-	ublksrv_pid = pid_nr(find_vpid(ublksrv_pid));
+	valid = find_vpid(ublksrv_pid) == ub->ublksrv_pid;
 	rcu_read_unlock();
 
-	return ub->ublksrv_tgid == ublksrv_pid;
+	return valid;
 }
 
 static bool ublk_dev_ready_or_stopping(const struct ublk_device *ub)

base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
-- 
2.43.0

Re: [PATCH] ublk: retain server PID generation across timeout

[shinichiro.kawasaki]

[-- Attachment #1: Type: text/plain, Size: 328 bytes --]

Dear patch submitter,

Blktests CI has tested the following submission:
Status:     FAILURE
Name:       ublk: retain server PID generation across timeout
Patchwork:  https://patchwork.kernel.org/series/1204811/&state=*
Run record: https://github.com/linux-blktests/linux-block/actions/runs/42362474433


All test cases passed

Re: [PATCH] ublk: retain server PID generation across timeout

[Shin'ichiro Kawasaki]

Please ignore this report. It was sent unexpectedly by blktestes-ci
misconfiguration. Sorry for the noise.