Re: [PATCH v2 00/12] cachefiles: some bugfixes and cleanups for ondemand requests

Jeff Layton
2024-05-19T10:56:50Z

On Wed, 2024-05-15 at 16:45 +0800, libaokun@huaweicloud.com wrote:
> From: Baokun Li <libaokun1@huawei.com>
>
> Hi all!
>
> This is the second version of this patch series. Thank you, Jia Zhu and
> Jingbo Xu, for the feedback in the previous version.
>
> We've been testing ondemand mode for cachefiles since January, and we're
> almost done. We hit a lot of issues during the testing period, and this
> patch set fixes some of the issues related to ondemand requests.
> The patches have passed internal testing without regression.
>
> The following is a brief overview of the patches, see the patches for
> more details.
>
> Patch 1-5: Holding reference counts of reqs and objects on read requests
> to avoid malicious restore leading to use-after-free.
>
> Patch 6-10: Add some consistency checks to copen/cread/get_fd to avoid
> malicious copen/cread/close fd injections causing use-after-free or hung.
>
> Patch 11: When cache is marked as CACHEFILES_DEAD, flush all requests,
> otherwise the kernel may be hung. since this state is irreversible, the
> daemon can read open requests but cannot copen.
>
> Patch 12: Allow interrupting a read request being processed by killing
> the read process as a way of avoiding hung in some special cases.
>
> Comments and questions are, as always, welcome.
> Please let me know what you think.
>
> Thanks,
> Baokun
>
> Changes since v1:
> * Collect RVB from Jia Zhu and Jingbo Xu.(Thanks for your review!)
> * Pathch 1: Add Fixes tag and enrich the commit message.
> * Pathch 7: Add function graph comments.
> * Pathch 8: Update commit message and comments.
> * Pathch 9: Enriched commit msg.
>
> Baokun Li (11):
> cachefiles: remove request from xarry during flush requests
> cachefiles: remove err_put_fd tag in cachefiles_ondemand_daemon_read()
> cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()
> cachefiles: fix slab-use-after-free in
> cachefiles_ondemand_daemon_read()
> cachefiles: add output string to cachefiles_obj_[get|put]_ondemand_fd
> cachefiles: add consistency check for copen/cread
> cachefiles: add spin_lock for cachefiles_ondemand_info
> cachefiles: never get a new anonymous fd if ondemand_id is valid
> cachefiles: defer exposing anon_fd until after copy_to_user() succeeds
> cachefiles: flush all requests after setting CACHEFILES_DEAD
> cachefiles: make on-demand read killable
>
> Zizhi Wo (1):
> cachefiles: Set object to close if ondemand_id < 0 in copen
>
> fs/cachefiles/daemon.c | 3 +-
> fs/cachefiles/internal.h | 5 +
> fs/cachefiles/ondemand.c | 218 ++++++++++++++++++++++--------
> include/trace/events/cachefiles.h | 8 +-
> 4 files changed, 177 insertions(+), 57 deletions(-)
>

Looks like most of these are fixes inside the ondemand code, which I
don't have the greatest grasp of, so...

Acked-by: Jeff Layton <jlayton@kernel.org>