rq->ref is not held when running a remote completion, and iteration
over tagset request pool is possible when another remote completion
is pending, so there is potential request UAF if request is completed
remotely from our tagset iterator helper.
Fix it by completing request locally if the completion is from tagset
iterator.
Suggested-by: Bart Van Assche <bvanassche@xxxxxxx>
Signed-off-by: Ming Lei <ming.lei@xxxxxxxxxx>
---
block/blk-mq-tag.c | 5 ++++-
block/blk-mq.c | 8 ++++++++
include/linux/blkdev.h | 2 ++
3 files changed, 14 insertions(+), 1 deletion(-)
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 100fa44d52a6..773aea4db90c 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -284,8 +284,11 @@ static bool bt_tags_iter(struct sbitmap *bitmap, unsigned int bitnr, void *data)
if ((iter_data->flags & BT_TAG_ITER_STARTED) &&
!blk_mq_request_started(rq))
ret = true;
- else
+ else {
+ rq->rq_flags |= RQF_ITERATING;
ret = iter_data->fn(rq, iter_data->data, reserved);
+ rq->rq_flags &= ~RQF_ITERATING;
+ }
if (!iter_static_rqs)
blk_mq_put_rq_ref(rq);
return ret;
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 4bd6c11bd8bc..ae06e5b3f215 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -654,6 +654,14 @@ bool blk_mq_complete_request_remote(struct request *rq)
if (rq->cmd_flags & REQ_HIPRI)
return false;
+ /*
+ * Complete the request locally if it is being completed via tagset
+ * iterator helper for avoiding UAF because rq->ref isn't held when
+ * running remote completion via IPI or softirq
+ */
+ if (rq->rq_flags & RQF_ITERATING)
+ return false;
+
if (blk_mq_complete_need_ipi(rq)) {
blk_mq_complete_send_ipi(rq);
return true;
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index f2e77ba97550..3b9bc4381dab 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -102,6 +102,8 @@ typedef __u32 __bitwise req_flags_t;
#define RQF_MQ_POLL_SLEPT ((__force req_flags_t)(1 << 20))
/* ->timeout has been called, don't expire again */
#define RQF_TIMED_OUT ((__force req_flags_t)(1 << 21))
+/* The request is being iterated by blk-mq iterator API */
+#define RQF_ITERATING ((__force req_flags_t)(1 << 22))
/* flags that prevent us from merging requests: */
#define RQF_NOMERGE_FLAGS \
--
2.29.2
