diff options
| author | Yu Kuai <yukuai3@huawei.com> | 2023-01-19 19:03:48 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-03-10 09:29:05 +0100 |
| commit | 57a425badc05c2e87e9f25713e5c3c0298e4202c (patch) | |
| tree | f6b1ebfe8da777c76c1139ec9bdafbe7438620b3 /block | |
| parent | b96d7b4a9745fbd0c8384608ceb1f50415e862fa (diff) | |
| download | linux-stable-57a425badc05c2e87e9f25713e5c3c0298e4202c.tar.gz linux-stable-57a425badc05c2e87e9f25713e5c3c0298e4202c.tar.bz2 linux-stable-57a425badc05c2e87e9f25713e5c3c0298e4202c.zip | |
blk-cgroup: dropping parent refcount after pd_free_fn() is done
[ Upstream commit c7241babf0855d8a6180cd1743ff0ec34de40b4e ]
Some cgroup policies will access parent pd through child pd even
after pd_offline_fn() is done. If pd_free_fn() for parent is called
before child, then UAF can be triggered. Hence it's better to guarantee
the order of pd_free_fn().
Currently refcount of parent blkg is dropped in __blkg_release(), which
is before pd_free_fn() is called in blkg_free_work_fn() while
blkg_free_work_fn() is called asynchronously.
This patch make sure pd_free_fn() called from removing cgroup is ordered
by delaying dropping parent refcount after calling pd_free_fn() for
child.
BTW, pd_free_fn() will also be called from blkcg_deactivate_policy()
from deleting device, and following patches will guarantee the order.
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20230119110350.2287325-2-yukuai1@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'block')
| -rw-r--r-- | block/blk-cgroup.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 9ac1efb053e0..aa890e3e4e50 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -124,6 +124,8 @@ static void blkg_free_workfn(struct work_struct *work) if (blkg->pd[i]) blkcg_policy[i]->pd_free_fn(blkg->pd[i]); + if (blkg->parent) + blkg_put(blkg->parent); if (blkg->q) blk_put_queue(blkg->q); free_percpu(blkg->iostat_cpu); @@ -158,8 +160,6 @@ static void __blkg_release(struct rcu_head *rcu) /* release the blkcg and parent blkg refs this blkg has been holding */ css_put(&blkg->blkcg->css); - if (blkg->parent) - blkg_put(blkg->parent); blkg_free(blkg); } |