On Tue, Apr 25, 2023 at 4:54 AM Yu Kuai <yukuai1@xxxxxxxxxxxxxxx> wrote:
>
> From: Yu Kuai <yukuai3@xxxxxxxxxx>
>
> Our test reports a uaf for 'mddev->sync_thread':
>
> T1 T2
> md_start_sync
> md_register_thread
> // mddev->sync_thread is set
> raid1d
> md_check_recovery
> md_reap_sync_thread
> md_unregister_thread
> kfree
>
> md_wakeup_thread
> wake_up
> ->sync_thread was freed
>
> Root cause is that there is a small windown between register thread and
> wake up thread, where the thread can be freed concurrently.
>
> Currently, a global spinlock 'pers_lock' is borrowed to protect
> 'mddev->thread', this problem can be fixed likewise, however, there are
> similar problems elsewhere, and use a global lock for all the cases is
> not good.
>
> This patch protect all md_thread with rcu.
>
> Signed-off-by: Yu Kuai <yukuai3@xxxxxxxxxx>
> ---
> block/blk-cgroup.c | 3 ++
> drivers/md/md-bitmap.c | 10 ++++--
> drivers/md/md-cluster.c | 17 ++++++----
> drivers/md/md-multipath.c | 4 +--
> drivers/md/md.c | 69 ++++++++++++++++++---------------------
> drivers/md/md.h | 8 ++---
> drivers/md/raid1.c | 7 ++--
> drivers/md/raid1.h | 2 +-
> drivers/md/raid10.c | 20 +++++++-----
> drivers/md/raid10.h | 2 +-
> drivers/md/raid5-cache.c | 22 ++++++++-----
> drivers/md/raid5.c | 15 +++++----
> drivers/md/raid5.h | 2 +-
> 13 files changed, 100 insertions(+), 81 deletions(-)
>
> diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
> index 1c1ebeb51003..0ecb4cce8af2 100644
> --- a/block/blk-cgroup.c
> +++ b/block/blk-cgroup.c
> @@ -527,6 +527,9 @@ static void blkg_destroy_all(struct gendisk *disk)
> list_for_each_entry_safe(blkg, n, &q->blkg_list, q_node) {
> struct blkcg *blkcg = blkg->blkcg;
>
> + if (hlist_unhashed(&blkg->blkcg_node))
> + continue;
> +
This change is not related, right?
I don't think we can rush this change in the 6.4 merge window. Let's
test it more thoroughly and ship it in the next merge window.
Thanks for working on this!
Song
[...]
