On 7/12/23 12:04, Yu Kuai wrote: > Subject: > Re: [PATCH v5 02/11] block: Block Device Filtering Mechanism > From: > Yu Kuai <yukuai1@xxxxxxxxxxxxxxx> > Date: > 7/12/23, 12:04 > > To: > Yu Kuai <yukuai1@xxxxxxxxxxxxxxx>, Sergei Shtepa <sergei.shtepa@xxxxxxxxx>, axboe@xxxxxxxxx, hch@xxxxxxxxxxxxx, corbet@xxxxxxx, snitzer@xxxxxxxxxx > CC: > viro@xxxxxxxxxxxxxxxxxx, brauner@xxxxxxxxxx, dchinner@xxxxxxxxxx, willy@xxxxxxxxxxxxx, dlemoal@xxxxxxxxxx, linux@xxxxxxxxxxxxxx, jack@xxxxxxx, ming.lei@xxxxxxxxxx, linux-block@xxxxxxxxxxxxxxx, linux-doc@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, linux-fsdevel@xxxxxxxxxxxxxxx, Donald Buczek <buczek@xxxxxxxxxxxxx>, "yukuai (C)" <yukuai3@xxxxxxxxxx> > > > Hi, > > 在 2023/07/11 10:02, Yu Kuai 写道: > >>> +static bool submit_bio_filter(struct bio *bio) >>> +{ >>> + if (bio_flagged(bio, BIO_FILTERED)) >>> + return false; >>> + >>> + bio_set_flag(bio, BIO_FILTERED); >>> + return bio->bi_bdev->bd_filter->ops->submit_bio(bio); >>> +} >>> + >>> static void __submit_bio(struct bio *bio) >>> { >>> + /* >>> + * If there is a filter driver attached, check if the BIO needs to go to >>> + * the filter driver first, which can then pass on the bio or consume it. >>> + */ >>> + if (bio->bi_bdev->bd_filter && submit_bio_filter(bio)) >>> + return; >>> + >>> if (unlikely(!blk_crypto_bio_prep(&bio))) >>> return; > > ... > >>> +static void __blkfilter_detach(struct block_device *bdev) >>> +{ >>> + struct blkfilter *flt = bdev->bd_filter; >>> + const struct blkfilter_operations *ops = flt->ops; >>> + >>> + bdev->bd_filter = NULL; >>> + ops->detach(flt); >>> + module_put(ops->owner); >>> +} >>> + >>> +void blkfilter_detach(struct block_device *bdev) >>> +{ >>> + if (bdev->bd_filter) { >>> + blk_mq_freeze_queue(bdev->bd_queue); > > And this is not sate as well, for bio-based device, q_usage_counter is > not grabbed while submit_bio_filter() is called, hence there is a risk > of uaf from submit_bio_filter(). > > Thanks, > Kuai > Hi Kuai. Indeed, the filter call is performed before calling bio_queue_enter(). I must admit, you are very attentive. I didn't keep track of the change in the position of the bio_queue_enter() function deeper on the stack. I think I need to add a check for q_usage_counter, for the debug build. So that I don't miss it in the future.