[PATCH] ext4: don't use the kiocb after a direct read was queued

[PATCH] ext4: don't use the kiocb after a direct read was queued

[Christian Brauner]

ext4_dio_read_iter() calls file_accessed(iocb->ki_filp) after it
submitted the direct read. But once the read was queued the kiocb
belongs to the completion handler. If the read completes before
ext4_dio_read_iter() gets to file_accessed() and the completion handler
frees the kiocb it reads freed memory.

aio and io_uring hold a reference to the kiocb until the submission
returned so they don't have that problem. The fileio backend of the
scsi target with fd_async_io=1 frees the kiocb in the completion
handler:

  BUG: KASAN: slab-use-after-free in ext4_dio_read_iter+0x5e1/0x690
  Workqueue: target_submission target_queued_submit_work
  Call Trace:
   <TASK>
   dump_stack_lvl+0x5d/0x80
   print_report+0x14b/0x4b0
   kasan_report+0x108/0x130
   ext4_dio_read_iter+0x5e1/0x690
   fd_execute_rw+0xd30/0x1700
   __target_execute_cmd+0x53/0x190
   transport_generic_new_cmd+0x65a/0xdb0
   __target_submit+0x12c/0x380
   target_queued_submit_work+0x73/0x270
   process_one_work+0x946/0x1820
   worker_thread+0x4f1/0xd60
   kthread+0x364/0x460
   ret_from_fork+0x525/0x770
   ret_from_fork_asm+0x1a/0x30
   </TASK>

  Allocated by task 59:
   __kmalloc_noprof+0x223/0x830
   fd_execute_rw+0x766/0x1700
   __target_execute_cmd+0x53/0x190
   transport_generic_new_cmd+0x65a/0xdb0
   __target_submit+0x12c/0x380
   target_queued_submit_work+0x73/0x270

  Freed by task 14:
   kfree+0x267/0x6a0
   blk_update_request+0x3f5/0x1260
   blk_mq_end_request+0x59/0x450
   blk_complete_reqs+0xb0/0x130
   handle_softirqs+0x20c/0x860
   run_ksoftirqd+0x31/0x60

Remember the file before the read is submitted. xfs avoids the same
problem by calling file_accessed() before it submits the read.

Fixes: b1b4705d54ab ("ext4: introduce direct I/O read using iomap infrastructure")
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
I hit this on v7.4-rc1 while testing the fileio backend of the scsi
target with fd_async_io=1 and the backing file on ext4. KASAN reliably
fires on the first direct reads through the LUN.

The fileio backend gets a fix as well so it doesn't free its kiocb under
the filesystem anymore. But ext4 shouldn't use the kiocb after the read
was queued either.
---
 fs/ext4/file.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 50d3c92709c8b..aefaeb2c51316 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -68,8 +68,9 @@ static bool ext4_should_use_dio(struct kiocb *iocb, struct iov_iter *iter)
 
 static ssize_t ext4_dio_read_iter(struct kiocb *iocb, struct iov_iter *to)
 {
+	struct file *file = iocb->ki_filp;
+	struct inode *inode = file_inode(file);
 	ssize_t ret;
-	struct inode *inode = file_inode(iocb->ki_filp);
 
 	if (iocb->ki_flags & IOCB_NOWAIT) {
 		if (!inode_trylock_shared(inode))
@@ -96,7 +97,8 @@ static ssize_t ext4_dio_read_iter(struct kiocb *iocb, struct iov_iter *to)
 		ret = iomap_dio_rw(iocb, to, &ext4_iomap_ops, NULL, 0, NULL, 0);
 	inode_unlock_shared(inode);
 
-	file_accessed(iocb->ki_filp);
+	/* The kiocb may be gone once the read was queued. */
+	file_accessed(file);
 	return ret;
 }
 

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261113-work-ext4-dio_read_kiocb-146d8f00da12

Re: [PATCH] ext4: don't use the kiocb after a direct read was queued

[sashiko-bot]

> ext4_dio_read_iter() calls file_accessed(iocb->ki_filp) after it
> submitted the direct read. But once the read was queued the kiocb
> belongs to the completion handler. If the read completes before
> ext4_dio_read_iter() gets to file_accessed() and the completion handler
> frees the kiocb it reads freed memory.
> 
> aio and io_uring hold a reference to the kiocb until the submission
> returned so they don't have that problem. The fileio backend of the
> scsi target with fd_async_io=1 frees the kiocb in the completion
> handler:
> 
>   BUG: KASAN: slab-use-after-free in ext4_dio_read_iter+0x5e1/0x690
>   Workqueue: target_submission target_queued_submit_work
>   Call Trace:
>    <TASK>
> [ ... ]
> Remember the file before the read is submitted. xfs avoids the same
> problem by calling file_accessed() before it submits the read.
> 
> Fixes: b1b4705d54ab ("ext4: introduce direct I/O read using iomap infrastructure")
> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113-work-ext4-dio_read_kiocb-v1-1-172a88be803c@kernel.org?part=1