Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1501404 > unrolled thread

[PATCH] aio: fix a use after free (and fix freeze protection of aio writes)

Back to article view | Back to linux.kernel

Contents

  [PATCH] aio: fix a use after free (and fix freeze protection of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-16 08:00 +0200
    Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes) Jeff Moyer <jmoyer@redhat.com> - 2016-10-17 20:30 +0200
      Re: [PATCH] aio: fix a use after free (and fix freeze protection         of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-17 21:00 +0200
        Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes) Jeff Moyer <jmoyer@redhat.com> - 2016-10-17 21:50 +0200
          Re: [PATCH] aio: fix a use after free (and fix freeze protection of  aio writes) Peter Zijlstra <peterz@infradead.org> - 2016-10-17 22:00 +0200
            Re: [PATCH] aio: fix a use after free (and fix freeze protection         of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-17 22:10 +0200
            Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes) Jeff Moyer <jmoyer@redhat.com> - 2016-10-17 22:10 +0200
        Re: [PATCH] aio: fix a use after free (and fix freeze protection of  aio writes) Peter Zijlstra <peterz@infradead.org> - 2016-10-17 22:00 +0200
    Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes) Jeff Moyer <jmoyer@redhat.com> - 2016-10-17 22:10 +0200
    Re: [PATCH] aio: fix a use after free (and fix freeze protection         of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-24 08:40 +0200

#1501404 — [PATCH] aio: fix a use after free (and fix freeze protection of aio writes)

From: Jan Kara <jack@suse.cz>

Currently we dropped freeze protection of aio writes just after IO was
submitted. Thus aio write could be in flight while the filesystem was
frozen and that could result in unexpected situation like aio completion
wanting to convert extent type on frozen filesystem. Testcase from
Dmitry triggering this is like:

for ((i=0;i<60;i++));do fsfreeze -f /mnt ;sleep 1;fsfreeze -u /mnt;done &
fio --bs=4k --ioengine=libaio --iodepth=128 --size=1g --direct=1 \
    --runtime=60 --filename=/mnt/file --name=rand-write --rw=randwrite

Fix the problem by dropping freeze protection only once IO is completed
in aio_complete().

[hch: The above was the changelog of the original patch from Jan.
 It turns out that it fixes something even more important - a use
 after free of the file structucture given that the direct I/O
 code calls fput and potentially drops the last reference to it in
 aio_complete.  Together with two racing threads and a zero sized
 I/O this seems easily exploitable]

Reported-by: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: Jan Kara <jack@suse.cz>
[hch: switch to use __sb_writers_acquired and file_inode(file),
      updated changelog]
Signed-off-by: Christoph Hellwig <hch@lst.de>
---
 fs/aio.c           | 28 +++++++++++++++++++++++++---
 include/linux/fs.h |  1 +
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/fs/aio.c b/fs/aio.c
index 1157e13..bf315cd 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1078,6 +1078,17 @@ static void aio_complete(struct kiocb *kiocb, long res, long res2)
 	unsigned tail, pos, head;
 	unsigned long	flags;
 
+	if (kiocb->ki_flags & IOCB_WRITE) {
+		struct file *file = kiocb->ki_filp;
+
+		/*
+		 * Tell lockdep we inherited freeze protection from submission
+		 * thread.
+		 */
+		__sb_writers_acquired(file_inode(file)->i_sb, SB_FREEZE_WRITE);
+		file_end_write(file);
+	}
+
 	/*
 	 * Special case handling for sync iocbs:
 	 *  - events go directly into the iocb for fast handling
@@ -1460,13 +1471,24 @@ static ssize_t aio_run_iocb(struct kiocb *req, unsigned opcode,
 			return ret;
 		}
 
-		if (rw == WRITE)
+		if (rw == WRITE) {
 			file_start_write(file);
+			req->ki_flags |= IOCB_WRITE;
+		}
+
+		if (rw == WRITE) {
+			/*
+			 * We release freeze protection in aio_complete(). Fool
+			 * lockdep by telling it the lock got released so that
+			 * it doesn't complain about held lock when we return
+			 * to userspace.
+			 */
+			__sb_writers_release(file_inode(file)->i_sb,
+					SB_FREEZE_WRITE);
+		}
 
 		ret = iter_op(req, &iter);
 
-		if (rw == WRITE)
-			file_end_write(file);
 		kfree(iovec);
 		break;
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 16d2b6e..db600e9 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -321,6 +321,7 @@ struct writeback_control;
 #define IOCB_HIPRI		(1 << 3)
 #define IOCB_DSYNC		(1 << 4)
 #define IOCB_SYNC		(1 << 5)
+#define IOCB_WRITE		(1 << 6)
 
 struct kiocb {
 	struct file		*ki_filp;
-- 
2.1.4

[toc] | [next] | [standalone]

#1502331

Hi, Christoph,

Christoph Hellwig <hch@lst.de> writes:

> diff --git a/fs/aio.c b/fs/aio.c
> index 1157e13..bf315cd 100644
> --- a/fs/aio.c
> +++ b/fs/aio.c
> @@ -1078,6 +1078,17 @@ static void aio_complete(struct kiocb *kiocb, long res, long res2)
>  	unsigned tail, pos, head;
>  	unsigned long	flags;
>  
> +	if (kiocb->ki_flags & IOCB_WRITE) {
> +		struct file *file = kiocb->ki_filp;
> +
> +		/*
> +		 * Tell lockdep we inherited freeze protection from submission
> +		 * thread.
> +		 */
> +		__sb_writers_acquired(file_inode(file)->i_sb, SB_FREEZE_WRITE);
> +		file_end_write(file);

This ends up being a call to __sb_end_write:

void __sb_end_write(struct super_block *sb, int level)
{
        percpu_up_read(sb->s_writers.rw_sem + level-1);
}

Nothing guarantees that submission and completion happen on the same
CPU.  Is this safe?

-Jeff

[toc] | [prev] | [next] | [standalone]

#1502344 — Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes)

On Mon, Oct 17, 2016 at 02:19:47PM -0400, Jeff Moyer wrote:
> This ends up being a call to __sb_end_write:
> 
> void __sb_end_write(struct super_block *sb, int level)
> {
>         percpu_up_read(sb->s_writers.rw_sem + level-1);
> }
> 
> Nothing guarantees that submission and completion happen on the same
> CPU.  Is this safe?

Good point.  From my reading of the percpu_rwsem implementation it
is not safe to release it from a different CPU.  Which makes me
wonder how we can protect aio writes properly here..

[toc] | [prev] | [next] | [standalone]

#1502385

Christoph Hellwig <hch@lst.de> writes:

> On Mon, Oct 17, 2016 at 02:19:47PM -0400, Jeff Moyer wrote:
>> This ends up being a call to __sb_end_write:
>> 
>> void __sb_end_write(struct super_block *sb, int level)
>> {
>>         percpu_up_read(sb->s_writers.rw_sem + level-1);
>> }
>> 
>> Nothing guarantees that submission and completion happen on the same
>> CPU.  Is this safe?
>
> Good point.  From my reading of the percpu_rwsem implementation it
> is not safe to release it from a different CPU.  Which makes me
> wonder how we can protect aio writes properly here..

Could we just change percpu_rw_semaphore->read_count to be a signed
integer?  The down_write path sums up the counters from all cpus...

-Jeff

[toc] | [prev] | [next] | [standalone]

#1502402 — Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes)

On Mon, Oct 17, 2016 at 03:40:24PM -0400, Jeff Moyer wrote:
> Christoph Hellwig <hch@lst.de> writes:
> 
> > On Mon, Oct 17, 2016 at 02:19:47PM -0400, Jeff Moyer wrote:
> >> This ends up being a call to __sb_end_write:
> >> 
> >> void __sb_end_write(struct super_block *sb, int level)
> >> {
> >>         percpu_up_read(sb->s_writers.rw_sem + level-1);
> >> }
> >> 
> >> Nothing guarantees that submission and completion happen on the same
> >> CPU.  Is this safe?
> >
> > Good point.  From my reading of the percpu_rwsem implementation it
> > is not safe to release it from a different CPU.  Which makes me
> > wonder how we can protect aio writes properly here..
> 
> Could we just change percpu_rw_semaphore->read_count to be a signed
> integer?  The down_write path sums up the counters from all cpus...

To what point?

[toc] | [prev] | [next] | [standalone]

#1502417 — Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes)

On Mon, Oct 17, 2016 at 04:04:00PM -0400, Jeff Moyer wrote:
> >> Could we just change percpu_rw_semaphore->read_count to be a signed
> >> integer?  The down_write path sums up the counters from all cpus...
> >
> > To what point?
> 
> Duh, nevermind.  You're right, it should work as-is.

Ok, thanks.  That also explains why I didn't see any splat in
xfstests..

[toc] | [prev] | [next] | [standalone]

#1502420

Peter Zijlstra <peterz@infradead.org> writes:

> On Mon, Oct 17, 2016 at 03:40:24PM -0400, Jeff Moyer wrote:
>> Christoph Hellwig <hch@lst.de> writes:
>> 
>> > On Mon, Oct 17, 2016 at 02:19:47PM -0400, Jeff Moyer wrote:
>> >> This ends up being a call to __sb_end_write:
>> >> 
>> >> void __sb_end_write(struct super_block *sb, int level)
>> >> {
>> >>         percpu_up_read(sb->s_writers.rw_sem + level-1);
>> >> }
>> >> 
>> >> Nothing guarantees that submission and completion happen on the same
>> >> CPU.  Is this safe?
>> >
>> > Good point.  From my reading of the percpu_rwsem implementation it
>> > is not safe to release it from a different CPU.  Which makes me
>> > wonder how we can protect aio writes properly here..
>> 
>> Could we just change percpu_rw_semaphore->read_count to be a signed
>> integer?  The down_write path sums up the counters from all cpus...
>
> To what point?

Duh, nevermind.  You're right, it should work as-is.

-Jeff

[toc] | [prev] | [next] | [standalone]

#1502411 — Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes)

On Mon, Oct 17, 2016 at 08:55:52PM +0200, Christoph Hellwig wrote:
> On Mon, Oct 17, 2016 at 02:19:47PM -0400, Jeff Moyer wrote:
> > This ends up being a call to __sb_end_write:
> > 
> > void __sb_end_write(struct super_block *sb, int level)
> > {
> >         percpu_up_read(sb->s_writers.rw_sem + level-1);
> > }
> > 
> > Nothing guarantees that submission and completion happen on the same
> > CPU.  Is this safe?
> 
> Good point.  From my reading of the percpu_rwsem implementation it
> is not safe to release it from a different CPU.  Which makes me
> wonder how we can protect aio writes properly here..

percpu-rwsem has the same semantics as regular rwsems, so preemptible
and 'owner' stuff.

Therefore we must support doing up from a different cpu than we did down
on; the owner could've been migrated while we held it.

And while there's a metric ton of tricky in the implementation, this
part is actually fairly straight forward. We only care about the direct
sum of the per-cpu counter, see readers_active_check() -> per_cpu_sum().

So one cpu doing an inc and another doing a dec summed is still 0.

[toc] | [prev] | [next] | [standalone]

#1502421

Christoph Hellwig <hch@lst.de> writes:

> From: Jan Kara <jack@suse.cz>
>
> Currently we dropped freeze protection of aio writes just after IO was
> submitted. Thus aio write could be in flight while the filesystem was
> frozen and that could result in unexpected situation like aio completion
> wanting to convert extent type on frozen filesystem. Testcase from
> Dmitry triggering this is like:
>
> for ((i=0;i<60;i++));do fsfreeze -f /mnt ;sleep 1;fsfreeze -u /mnt;done &
> fio --bs=4k --ioengine=libaio --iodepth=128 --size=1g --direct=1 \
>     --runtime=60 --filename=/mnt/file --name=rand-write --rw=randwrite
>
> Fix the problem by dropping freeze protection only once IO is completed
> in aio_complete().
>
> [hch: The above was the changelog of the original patch from Jan.
>  It turns out that it fixes something even more important - a use
>  after free of the file structucture given that the direct I/O
>  code calls fput and potentially drops the last reference to it in
>  aio_complete.  Together with two racing threads and a zero sized
>  I/O this seems easily exploitable]
>
> Reported-by: Dmitry Monakhov <dmonakhov@openvz.org>
> Signed-off-by: Jan Kara <jack@suse.cz>
> [hch: switch to use __sb_writers_acquired and file_inode(file),
>       updated changelog]
> Signed-off-by: Christoph Hellwig <hch@lst.de>

Reviewed-by: Jeff Moyer <jmoyer@redhat.com>

[toc] | [prev] | [next] | [standalone]

#1506931 — Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes)

Al,

any chance to send this user triggerable use after free on to Linus?

On Sun, Oct 16, 2016 at 07:51:22AM +0200, Christoph Hellwig wrote:
> From: Jan Kara <jack@suse.cz>
> 
> Currently we dropped freeze protection of aio writes just after IO was
> submitted. Thus aio write could be in flight while the filesystem was
> frozen and that could result in unexpected situation like aio completion
> wanting to convert extent type on frozen filesystem. Testcase from
> Dmitry triggering this is like:
> 
> for ((i=0;i<60;i++));do fsfreeze -f /mnt ;sleep 1;fsfreeze -u /mnt;done &
> fio --bs=4k --ioengine=libaio --iodepth=128 --size=1g --direct=1 \
>     --runtime=60 --filename=/mnt/file --name=rand-write --rw=randwrite
> 
> Fix the problem by dropping freeze protection only once IO is completed
> in aio_complete().
> 
> [hch: The above was the changelog of the original patch from Jan.
>  It turns out that it fixes something even more important - a use
>  after free of the file structucture given that the direct I/O
>  code calls fput and potentially drops the last reference to it in
>  aio_complete.  Together with two racing threads and a zero sized
>  I/O this seems easily exploitable]
> 
> Reported-by: Dmitry Monakhov <dmonakhov@openvz.org>
> Signed-off-by: Jan Kara <jack@suse.cz>
> [hch: switch to use __sb_writers_acquired and file_inode(file),
>       updated changelog]
> Signed-off-by: Christoph Hellwig <hch@lst.de>
> ---
>  fs/aio.c           | 28 +++++++++++++++++++++++++---
>  include/linux/fs.h |  1 +
>  2 files changed, 26 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/aio.c b/fs/aio.c
> index 1157e13..bf315cd 100644
> --- a/fs/aio.c
> +++ b/fs/aio.c
> @@ -1078,6 +1078,17 @@ static void aio_complete(struct kiocb *kiocb, long res, long res2)
>  	unsigned tail, pos, head;
>  	unsigned long	flags;
>  
> +	if (kiocb->ki_flags & IOCB_WRITE) {
> +		struct file *file = kiocb->ki_filp;
> +
> +		/*
> +		 * Tell lockdep we inherited freeze protection from submission
> +		 * thread.
> +		 */
> +		__sb_writers_acquired(file_inode(file)->i_sb, SB_FREEZE_WRITE);
> +		file_end_write(file);
> +	}
> +
>  	/*
>  	 * Special case handling for sync iocbs:
>  	 *  - events go directly into the iocb for fast handling
> @@ -1460,13 +1471,24 @@ static ssize_t aio_run_iocb(struct kiocb *req, unsigned opcode,
>  			return ret;
>  		}
>  
> -		if (rw == WRITE)
> +		if (rw == WRITE) {
>  			file_start_write(file);
> +			req->ki_flags |= IOCB_WRITE;
> +		}
> +
> +		if (rw == WRITE) {
> +			/*
> +			 * We release freeze protection in aio_complete(). Fool
> +			 * lockdep by telling it the lock got released so that
> +			 * it doesn't complain about held lock when we return
> +			 * to userspace.
> +			 */
> +			__sb_writers_release(file_inode(file)->i_sb,
> +					SB_FREEZE_WRITE);
> +		}
>  
>  		ret = iter_op(req, &iter);
>  
> -		if (rw == WRITE)
> -			file_end_write(file);
>  		kfree(iovec);
>  		break;
>  
> diff --git a/include/linux/fs.h b/include/linux/fs.h
> index 16d2b6e..db600e9 100644
> --- a/include/linux/fs.h
> +++ b/include/linux/fs.h
> @@ -321,6 +321,7 @@ struct writeback_control;
>  #define IOCB_HIPRI		(1 << 3)
>  #define IOCB_DSYNC		(1 << 4)
>  #define IOCB_SYNC		(1 << 5)
> +#define IOCB_WRITE		(1 << 6)
>  
>  struct kiocb {
>  	struct file		*ki_filp;
> -- 
> 2.1.4
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
---end quoted text---

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web