Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1511860

Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes)

Show all headers | View raw

On Sat, Oct 29, 2016 at 10:47:58AM -0700, Linus Torvalds wrote:

> Also, honestly, make it use a helper: "aio_file_start_write()" and
> "aio_file_end_write()" that has the comments and the lockdep games.
> 
> Because that patch is just too effing ugly.
> 
> Does something like the attached work for you guys?

No.  The use-after-free problem is real, nasty and only papered over by
that patch.

What happens is that io_submit_one()
	* allocates aio_kiocb
	* does fget() and stuffs the struct file * into kiocb
	* in case of early problems we call kiocb_free(), freeing kiocb and
doing fput() on file, then bugger off.
	* otherwise, eventually we get to passing that iocb to
->read_iter()/->write_iter().
	* if that has resulted in anything other than -EIOCBQUEUED, we
call aio_complete(), which calls kiocb_free(), freeing kiocb and doing fput()
on file.
	* if ->{read,write}_iter() returns -EIOCBQUEUED, we expect
aio_complete() to be called asynchronously.

And that call can happen as soon as we return from __blockdev_direct_IO()
(even earlier, actually).  As soon as that happens, the reference to
struct file we'd acquired in io_submit_one() is dropped.  If descriptor
table had been shared, another thread might have already closed that sucker,
and fput() from aio_complete() would free struct file.

That's what this patch is papering over.  Because if we hit that scenario
and struct file *does* get closed asynchronously just as our ->write_iter()
is returning from __blockdev_direct_IO(), we are fucked.  Not only struct
file might be freed - struct inode might've been gone too.  And a bunch
of ->write_iter/->read_iter instances do access struct inode after the call
of __blockdev_direct_IO().  file_write_end() is just the tip of the iceberg -
see examples I've posted today for the things we *can't* move around.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-29 09:50 +0200
  Re: [PATCH] aio: fix a user triggered use after free (and fix freeze  protection of aio writes) Al Viro <viro@ZenIV.linux.org.uk> - 2016-10-29 14:30 +0200
    Re: [PATCH] aio: fix a user triggered use after free (and fix         freeze protection of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-29 17:30 +0200
      Re: [PATCH] aio: fix a user triggered use after free (and fix freeze  protection of aio writes) Al Viro <viro@ZenIV.linux.org.uk> - 2016-10-29 18:20 +0200
        Re: [PATCH] aio: fix a user triggered use after free (and fix freeze  protection of aio writes) Al Viro <viro@ZenIV.linux.org.uk> - 2016-10-29 18:40 +0200
        Re: [PATCH] aio: fix a user triggered use after free (and fix         freeze protection of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-30 07:40 +0100
      Re: [PATCH] aio: fix a user triggered use after free (and fix freeze  protection of aio writes) Linus Torvalds <torvalds@linux-foundation.org> - 2016-10-29 19:50 +0200
        Re: [PATCH] aio: fix a user triggered use after free (and fix freeze  protection of aio writes) Al Viro <viro@ZenIV.linux.org.uk> - 2016-10-29 21:00 +0200
          Re: [PATCH] aio: fix a user triggered use after free (and fix freeze  protection of aio writes) Linus Torvalds <torvalds@linux-foundation.org> - 2016-10-29 21:10 +0200
            Re: [PATCH] aio: fix a user triggered use after free (and fix freeze  protection of aio writes) Al Viro <viro@ZenIV.linux.org.uk> - 2016-10-29 21:20 +0200
              Re: [PATCH] aio: fix a user triggered use after free (and fix freeze  protection of aio writes) Linus Torvalds <torvalds@linux-foundation.org> - 2016-10-29 22:10 +0200
                Re: [PATCH] aio: fix a user triggered use after free (and fix freeze  protection of aio writes) Jan Kara <jack@suse.cz> - 2016-10-30 10:50 +0100
                Re: [PATCH] aio: fix a user triggered use after free (and fix freeze  protection of aio writes) Jan Kara <jack@suse.cz> - 2016-10-30 12:00 +0100
                Re: [PATCH] aio: fix a user triggered use after free (and fix         freeze protection of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-30 17:00 +0100
        Re: [PATCH] aio: fix a user triggered use after free (and fix         freeze protection of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-30 07:40 +0100

csiph-web