From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.5 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS,USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 548BAC43610 for ; Mon, 26 Nov 2018 14:17:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1F03E20663 for ; Mon, 26 Nov 2018 14:17:59 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1F03E20663 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726702AbeK0BMN (ORCPT ); Mon, 26 Nov 2018 20:12:13 -0500 Received: from mx1.redhat.com ([209.132.183.28]:55272 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726200AbeK0BMM (ORCPT ); Mon, 26 Nov 2018 20:12:12 -0500 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 15EAB37E8E; Mon, 26 Nov 2018 14:17:57 +0000 (UTC) Received: from bfoster (dhcp-41-2.bos.redhat.com [10.18.41.2]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 66A0F1A926; Mon, 26 Nov 2018 14:17:52 +0000 (UTC) Date: Mon, 26 Nov 2018 09:17:50 -0500 From: Brian Foster To: PanBian Cc: Carlos Maiolino , "Darrick J. Wong" , linux-xfs@vger.kernel.org, Dave Chinner , linux-kernel@vger.kernel.org Subject: Re: [PATCH] xfs: libxfs: move xfs_perag_put late Message-ID: <20181126141750.GA14585@bfoster> References: <1543052660-58625-1-git-send-email-bianpan2016@163.com> <20181126093139.cgojlmtubzuzdb23@hades.usersys.redhat.com> <20181126103619.GA95394@bp> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20181126103619.GA95394@bp> User-Agent: Mutt/1.10.1 (2018-07-13) X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Mon, 26 Nov 2018 14:17:57 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Nov 26, 2018 at 06:36:19PM +0800, PanBian wrote: > On Mon, Nov 26, 2018 at 10:31:39AM +0100, Carlos Maiolino wrote: > > On Sat, Nov 24, 2018 at 05:44:20PM +0800, Pan Bian wrote: > > > The function xfs_alloc_get_freelist calls xfs_perag_put to drop the > > > reference. In this case, pag may be released. However, > > > pag->pagf_btreeblks is read and write after the put operation. This may > > > result in a use-after-free bug. This patch moves the put operation late. > > > > > > > The patch looks reasonable, can you detail more how did you find it? Via code > > inspection of you hit this user-after-free in some way? > > I wrote a tool to check such bugs statically. It first scans the source code > to extract paired alloc/free functions. Equipped with such functions, it > performs an intra-procedural data flow analysis to detect mismatched > alloc/free bugs and use-after-free bugs. > You should probably drop the "use after free" text from your commit log because that's not how the perag reference counting works. If you look at xfs_perag_put(), you'll see it only drops a reference count and returns. We only ever free the perag structs on unmount (or mount failure), where we assert the refcount is zero. It looks like some other serialization mechanism would have to break down for that assert to fail due to this error in the allocation code because the fs is mostly shut down at this point in time. Misleading commit log aside, the change seems fine to me. I think it's appropriate to follow the traditional/implied _get()/_put() pattern. Brian > Best regards, > Pan Bian >