Re: [PATCH v2] io-wq: Fix UAF when wakeup wqe in hash waitqueue

[Jens Axboe]

On 5/25/21 11:08 PM, qiang.zhang@xxxxxxxxxxxxx wrote:
> From: Zqiang <qiang.zhang@xxxxxxxxxxxxx>
> 
> BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650
> Read of size 8 at addr ffff8880304250d8 by task iou-wrk-28796/28802
> 
> Call Trace:
>  __dump_stack [inline]
>  dump_stack+0x141/0x1d7
>  print_address_description.constprop.0.cold+0x5b/0x2c6
>  __kasan_report [inline]
>  kasan_report.cold+0x7c/0xd8
>  __wake_up_common+0x637/0x650
>  __wake_up_common_lock+0xd0/0x130
>  io_worker_handle_work+0x9dd/0x1790
>  io_wqe_worker+0xb2a/0xd40
>  ret_from_fork+0x1f/0x30
> 
> Allocated by task 28798:
>  kzalloc_node [inline]
>  io_wq_create+0x3c4/0xdd0
>  io_init_wq_offload [inline]
>  io_uring_alloc_task_context+0x1bf/0x6b0
>  __io_uring_add_task_file+0x29a/0x3c0
>  io_uring_add_task_file [inline]
>  io_uring_install_fd [inline]
>  io_uring_create [inline]
>  io_uring_setup+0x209a/0x2bd0
>  do_syscall_64+0x3a/0xb0
>  entry_SYSCALL_64_after_hwframe+0x44/0xae
> 
> Freed by task 28798:
>  kfree+0x106/0x2c0
>  io_wq_destroy+0x182/0x380
>  io_wq_put [inline]
>  io_wq_put_and_exit+0x7a/0xa0
>  io_uring_clean_tctx [inline]
>  __io_uring_cancel+0x428/0x530
>  io_uring_files_cancel
>  do_exit+0x299/0x2a60
>  do_group_exit+0x125/0x310
>  get_signal+0x47f/0x2150
>  arch_do_signal_or_restart+0x2a8/0x1eb0
>  handle_signal_work[inline]
>  exit_to_user_mode_loop [inline]
>  exit_to_user_mode_prepare+0x171/0x280
>  __syscall_exit_to_user_mode_work [inline]
>  syscall_exit_to_user_mode+0x19/0x60
>  do_syscall_64+0x47/0xb0
>  entry_SYSCALL_64_after_hwframe
> 
> There are the following scenarios, hash waitqueue is shared by
> io-wq1 and io-wq2. (note: wqe is worker)
> 
> io-wq1:worker2     | locks bit1
> io-wq2:worker1     | waits bit1
> io-wq1:worker3     | waits bit1
> 
> io-wq1:worker2     | completes all wqe bit1 work items
> io-wq1:worker2     | drop bit1, exit
> 
> io-wq2:worker1     | locks bit1
> io-wq1:worker3     | can not locks bit1, waits bit1 and exit
> io-wq1             | exit and free io-wq1
> io-wq2:worker1     | drops bit1
> io-wq1:worker3     | be waked up, even though wqe is freed
> 
> After all iou-wrk belonging to io-wq1 have exited, remove wqe
> form hash waitqueue, it is guaranteed that there will be no more
> wqe belonging to io-wq1 in the hash waitqueue.

Thanks, applied.

-- 
Jens Axboe