23. September 2023.
Hallo,
Ich möchte Ihnen einen Geschäftsvorschlag mitteilen. Für weitere
Details antworten Sie auf Englisch.
Grüße
Frau Victoria Cleland
_________________________
Sekretärin: Lamya Essaoui
From: Ming Lei <ming.lei(a)redhat.com>
commit d36a9ea5e7766961e753ee38d4c331bbe6ef659b upstream.
For blk-mq, queue release handler is usually called after
blk_mq_freeze_queue_wait() returns. However, the
q_usage_counter->release() handler may not be run yet at that time, so
this can cause a use-after-free.
Fix the issue by moving percpu_ref_exit() into blk_free_queue_rcu().
Since ->release() is called with rcu read lock held, it is agreed that
the race should be covered in caller per discussion from the two links.
Backport-notes: Not a clean cherry-pick since a lot has changed,
however essentially the same fix.
Reported-by: Zhang Wensheng <zhangwensheng(a)huaweicloud.com>
Reported-by: Zhong Jinghua <zhongjinghua(a)huawei.com>
Link: https://lore.kernel.org/linux-block/Y5prfOjyyjQKUrtH@T590/T/#u
Link: https://lore.kernel.org/lkml/Y4%2FmzMd4evRg9yDi@fedora/
Cc: Hillf Danton <hdanton(a)sina.com>
Cc: Yu Kuai <yukuai3(a)huawei.com>
Cc: Dennis Zhou <dennis(a)kernel.org>
Fixes: 2b0d3d3e4fcf ("percpu_ref: reduce memory footprint of percpu_ref in fast path")
Signed-off-by: Ming Lei <ming.lei(a)redhat.com>
Link: https://lore.kernel.org/r/20221215021629.74870-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Saranya Muruganandam <saranyamohan(a)google.com>
---
block/blk-sysfs.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index a582ea0da74f..a82bdec923b2 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -737,6 +737,7 @@ static void blk_free_queue_rcu(struct rcu_head *rcu_head)
struct request_queue *q = container_of(rcu_head, struct request_queue,
rcu_head);
+ percpu_ref_exit(&q->q_usage_counter);
kmem_cache_free(blk_get_queue_kmem_cache(blk_queue_has_srcu(q)), q);
}
@@ -762,8 +763,6 @@ static void blk_release_queue(struct kobject *kobj)
might_sleep();
- percpu_ref_exit(&q->q_usage_counter);
-
if (q->poll_stat)
blk_stat_remove_callback(q, q->poll_cb);
blk_stat_free_callback(q->poll_cb);
--
2.42.0.515.g380fc7ccd1-goog
Hi Greg, Sasha,
The following list shows the backported patches, this batch is targeting
at garbage collection (GC) / set timeout fixes that address possible UaF
and memleaks. I am using original commit IDs for reference:
1) 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol")
2) 24138933b97b ("netfilter: nf_tables: don't skip expired elements during walk")
3) 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
4) f6c383b8c31a ("netfilter: nf_tables: adapt set backend to use GC transaction API")
5) c92db3030492 ("netfilter: nft_set_hash: mark set element as dead when deleting from packet path")
6) a2dd0233cbc4 ("netfilter: nf_tables: remove busy mark and gc batch API")
7) 7845914f45f0 ("netfilter: nf_tables: don't fail inserts if duplicate has expired")
8) 6a33d8b73dfa ("netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path")
9) 02c6c24402bf ("netfilter: nf_tables: GC transaction race with netns dismantle")
10) 720344340fb9 ("netfilter: nf_tables: GC transaction race with abort path")
11) 8357bc946a2a ("netfilter: nf_tables: use correct lock to protect gc_list")
12) 8e51830e29e1 ("netfilter: nf_tables: defer gc run if previous batch is still pending")
13) 2ee52ae94baa ("netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction")
14) 96b33300fba8 ("netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention")
15) 6d365eabce3c ("netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails")
16) b079155faae9 ("netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration")
17) cf5000a7787c ("netfilter: nf_tables: fix memleak when more than 255 elements expired")
Please, apply.
Thanks.
Florian Westphal (4):
netfilter: nf_tables: don't skip expired elements during walk
netfilter: nf_tables: don't fail inserts if duplicate has expired
netfilter: nf_tables: defer gc run if previous batch is still pending
netfilter: nf_tables: fix memleak when more than 255 elements expired
Pablo Neira Ayuso (13):
netfilter: nf_tables: integrate pipapo into commit protocol
netfilter: nf_tables: GC transaction API to avoid race with control plane
netfilter: nf_tables: adapt set backend to use GC transaction API
netfilter: nft_set_hash: mark set element as dead when deleting from packet path
netfilter: nf_tables: remove busy mark and gc batch API
netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
netfilter: nf_tables: GC transaction race with netns dismantle
netfilter: nf_tables: GC transaction race with abort path
netfilter: nf_tables: use correct lock to protect gc_list
netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails
netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
include/net/netfilter/nf_tables.h | 125 +++++------
net/netfilter/nf_tables_api.c | 341 +++++++++++++++++++++++++++---
net/netfilter/nft_set_hash.c | 87 +++++---
net/netfilter/nft_set_pipapo.c | 115 ++++++----
net/netfilter/nft_set_rbtree.c | 157 ++++++++------
5 files changed, 589 insertions(+), 236 deletions(-)
--
2.30.2