]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
blktrace: Protect q->blk_trace with RCU
authorJan Kara <jack@suse.cz>
Thu, 6 Feb 2020 14:28:12 +0000 (15:28 +0100)
committerBen Hutchings <ben@decadent.org.uk>
Tue, 28 Apr 2020 18:03:38 +0000 (19:03 +0100)
commit4398bce1bdf258f7d67bcc38c46f5fa9546448bd
treec341a23b8b1e16ed828282e51f13a290b043140a
parent12b91f8bd81a4e97c86bbf4ebbec35fec7c33dce
blktrace: Protect q->blk_trace with RCU

commit c780e86dd48ef6467a1146cf7d0fe1e05a635039 upstream.

KASAN is reporting that __blk_add_trace() has a use-after-free issue
when accessing q->blk_trace. Indeed the switching of block tracing (and
thus eventual freeing of q->blk_trace) is completely unsynchronized with
the currently running tracing and thus it can happen that the blk_trace
structure is being freed just while __blk_add_trace() works on it.
Protect accesses to q->blk_trace by RCU during tracing and make sure we
wait for the end of RCU grace period when shutting down tracing. Luckily
that is rare enough event that we can afford that. Note that postponing
the freeing of blk_trace to an RCU callback should better be avoided as
it could have unexpected user visible side-effects as debugfs files
would be still existing for a short while block tracing has been shut
down.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=205711
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Tested-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reported-by: Tristan Madani <tristmd@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[bwh: Backported to 3.16:
 - Drop changes in blk_trace_note_message_enabled(), blk_trace_bio_get_cgid()
 - Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
include/linux/blkdev.h
include/linux/blktrace_api.h
kernel/trace/blktrace.c