Zach Wade cf5a60d971 Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()" ... This reverts commit bc3b1e9e7c. The bic is associated with sync_bfqq, and bfq_release_process_ref cannot be put into bfq_put_cooperator. kasan report: [ 400.347277] ================================================================== [ 400.347287] BUG: KASAN: slab-use-after-free in bic_set_bfqq+0x200/0x230 [ 400.347420] Read of size 8 at addr ffff88881cab7d60 by task dockerd/5800 [ 400.347430] [ 400.347436] CPU: 24 UID: 0 PID: 5800 Comm: dockerd Kdump: loaded Tainted: G E 6.12.0 #32 [ 400.347450] Tainted: [E]=UNSIGNED_MODULE [ 400.347454] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022 [ 400.347460] Call Trace: [ 400.347464] <TASK> [ 400.347468] dump_stack_lvl+0x5d/0x80 [ 400.347490] print_report+0x174/0x505 [ 400.347521] kasan_report+0xe0/0x160 [ 400.347541] bic_set_bfqq+0x200/0x230 [ 400.347549] bfq_bic_update_cgroup+0x419/0x740 [ 400.347560] bfq_bio_merge+0x133/0x320 [ 400.347584] blk_mq_submit_bio+0x1761/0x1e20 [ 400.347625] __submit_bio+0x28b/0x7b0 [ 400.347664] submit_bio_noacct_nocheck+0x6b2/0xd30 [ 400.347690] iomap_readahead+0x50c/0x680 [ 400.347731] read_pages+0x17f/0x9c0 [ 400.347785] page_cache_ra_unbounded+0x366/0x4a0 [ 400.347795] filemap_fault+0x83d/0x2340 [ 400.347819] __xfs_filemap_fault+0x11a/0x7d0 [xfs] [ 400.349256] __do_fault+0xf1/0x610 [ 400.349270] do_fault+0x977/0x11a0 [ 400.349281] __handle_mm_fault+0x5d1/0x850 [ 400.349314] handle_mm_fault+0x1f8/0x560 [ 400.349324] do_user_addr_fault+0x324/0x970 [ 400.349337] exc_page_fault+0x76/0xf0 [ 400.349350] asm_exc_page_fault+0x26/0x30 [ 400.349360] RIP: 0033:0x55a480d77375 [ 400.349384] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 ae 02 00 00 55 48 89 e5 48 83 ec 58 48 8b 10 <83> 7a 10 00 0f 84 27 02 00 00 44 0f b6 42 28 44 0f b6 4a 29 41 80 [ 400.349392] RSP: 002b:00007f18c37fd8b8 EFLAGS: 00010216 [ 400.349401] RAX: 00007f18c37fd9d0 RBX: 0000000000000000 RCX: 0000000000000000 [ 400.349407] RDX: 000055a484407d38 RSI: 000000c000e8b0c0 RDI: 0000000000000000 [ 400.349412] RBP: 00007f18c37fd910 R08: 000055a484017f60 R09: 000055a484066f80 [ 400.349417] R10: 0000000000194000 R11: 0000000000000005 R12: 0000000000000008 [ 400.349422] R13: 0000000000000000 R14: 000000c000476a80 R15: 0000000000000000 [ 400.349430] </TASK> [ 400.349452] [ 400.349454] Allocated by task 5800: [ 400.349459] kasan_save_stack+0x30/0x50 [ 400.349469] kasan_save_track+0x14/0x30 [ 400.349475] __kasan_slab_alloc+0x89/0x90 [ 400.349482] kmem_cache_alloc_node_noprof+0xdc/0x2a0 [ 400.349492] bfq_get_queue+0x1ef/0x1100 [ 400.349502] __bfq_get_bfqq_handle_split+0x11a/0x510 [ 400.349511] bfq_insert_requests+0xf55/0x9030 [ 400.349519] blk_mq_flush_plug_list+0x446/0x14c0 [ 400.349527] __blk_flush_plug+0x27c/0x4e0 [ 400.349534] blk_finish_plug+0x52/0xa0 [ 400.349540] _xfs_buf_ioapply+0x739/0xc30 [xfs] [ 400.350246] __xfs_buf_submit+0x1b2/0x640 [xfs] [ 400.350967] xfs_buf_read_map+0x306/0xa20 [xfs] [ 400.351672] xfs_trans_read_buf_map+0x285/0x7d0 [xfs] [ 400.352386] xfs_imap_to_bp+0x107/0x270 [xfs] [ 400.353077] xfs_iget+0x70d/0x1eb0 [xfs] [ 400.353786] xfs_lookup+0x2ca/0x3a0 [xfs] [ 400.354506] xfs_vn_lookup+0x14e/0x1a0 [xfs] [ 400.355197] __lookup_slow+0x19c/0x340 [ 400.355204] lookup_one_unlocked+0xfc/0x120 [ 400.355211] ovl_lookup_single+0x1b3/0xcf0 [overlay] [ 400.355255] ovl_lookup_layer+0x316/0x490 [overlay] [ 400.355295] ovl_lookup+0x844/0x1fd0 [overlay] [ 400.355351] lookup_one_qstr_excl+0xef/0x150 [ 400.355357] do_unlinkat+0x22a/0x620 [ 400.355366] __x64_sys_unlinkat+0x109/0x1e0 [ 400.355375] do_syscall_64+0x82/0x160 [ 400.355384] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 400.355393] [ 400.355395] Freed by task 5800: [ 400.355400] kasan_save_stack+0x30/0x50 [ 400.355407] kasan_save_track+0x14/0x30 [ 400.355413] kasan_save_free_info+0x3b/0x70 [ 400.355422] __kasan_slab_free+0x4f/0x70 [ 400.355429] kmem_cache_free+0x176/0x520 [ 400.355438] bfq_put_queue+0x67e/0x980 [ 400.355447] bfq_bic_update_cgroup+0x407/0x740 [ 400.355454] bfq_bio_merge+0x133/0x320 [ 400.355460] blk_mq_submit_bio+0x1761/0x1e20 [ 400.355467] __submit_bio+0x28b/0x7b0 [ 400.355473] submit_bio_noacct_nocheck+0x6b2/0xd30 [ 400.355480] iomap_readahead+0x50c/0x680 [ 400.355490] read_pages+0x17f/0x9c0 [ 400.355498] page_cache_ra_unbounded+0x366/0x4a0 [ 400.355505] filemap_fault+0x83d/0x2340 [ 400.355514] __xfs_filemap_fault+0x11a/0x7d0 [xfs] [ 400.356204] __do_fault+0xf1/0x610 [ 400.356213] do_fault+0x977/0x11a0 [ 400.356221] __handle_mm_fault+0x5d1/0x850 [ 400.356230] handle_mm_fault+0x1f8/0x560 [ 400.356238] do_user_addr_fault+0x324/0x970 [ 400.356248] exc_page_fault+0x76/0xf0 [ 400.356258] asm_exc_page_fault+0x26/0x30 [ 400.356266] [ 400.356269] The buggy address belongs to the object at ffff88881cab7bc0 which belongs to the cache bfq_queue of size 576 [ 400.356276] The buggy address is located 416 bytes inside of freed 576-byte region [ffff88881cab7bc0, ffff88881cab7e00) [ 400.356285] [ 400.356287] The buggy address belongs to the physical page: [ 400.356292] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88881cab0b00 pfn:0x81cab0 [ 400.356300] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 400.356323] flags: 0x50000000000040(head|node=1|zone=2) [ 400.356331] page_type: f5(slab) [ 400.356340] raw: 0050000000000040 ffff88880a00c280 dead000000000122 0000000000000000 [ 400.356347] raw: ffff88881cab0b00 00000000802e0025 00000001f5000000 0000000000000000 [ 400.356354] head: 0050000000000040 ffff88880a00c280 dead000000000122 0000000000000000 [ 400.356359] head: ffff88881cab0b00 00000000802e0025 00000001f5000000 0000000000000000 [ 400.356365] head: 0050000000000003 ffffea002072ac01 ffffffffffffffff 0000000000000000 [ 400.356370] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 400.356378] page dumped because: kasan: bad access detected [ 400.356381] [ 400.356383] Memory state around the buggy address: [ 400.356387] ffff88881cab7c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 400.356392] ffff88881cab7c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 400.356397] >ffff88881cab7d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 400.356400] ^ [ 400.356405] ffff88881cab7d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 400.356409] ffff88881cab7e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 400.356413] ================================================================== Cc: stable@vger.kernel.org Fixes: bc3b1e9e7c ("block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()") Signed-off-by: Zach Wade <zachwade.k@gmail.com> Cc: Ding Hui <dinghui@sangfor.com.cn> Reviewed-by: Yu Kuai <yukuai3@huawei.com> Link: https://lore.kernel.org/r/20241119153410.2546-1-zachwade.k@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>		2024-11-19 19:05:32 -07:00
..
partitions	block: add partition uuid into uevent as "PARTUUID"	2024-10-22 08:15:17 -06:00
badblocks.c	badblocks: avoid checking invalid range in badblocks_check()	2023-12-23 18:38:08 -07:00
bdev.c	for-6.12/block-20240925	2024-09-25 14:56:40 -07:00
bfq-cgroup.c	Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()"	2024-11-19 19:05:32 -07:00
bfq-iosched.c	Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()"	2024-11-19 19:05:32 -07:00
bfq-iosched.h	block, bfq: remove bfq_log_bfqg()	2024-09-10 16:32:09 -06:00
bfq-wf2q.c	block, bfq: inject I/O to underutilized actuators	2023-01-29 15:18:33 -07:00
bio-integrity.c	blk-integrity: remove seed for user mapped buffers	2024-10-30 07:49:32 -06:00
bio.c	block: Error an attempt to split an atomic write in bio_split()	2024-11-11 08:35:46 -07:00
blk-cgroup-fc-appid.c	block: Replace all non-returning strlcpy with strscpy	2023-06-01 09:13:31 -06:00
blk-cgroup-rwstat.c	blk-cgroup: use group allocation/free of per-cpu counters API	2024-04-03 09:10:17 -06:00
blk-cgroup-rwstat.h	block: Use the new blk_opf_t type	2022-07-14 12:14:30 -06:00
blk-cgroup.c	blk-ioprio: remove per-disk structure	2024-07-28 16:47:51 -06:00
blk-cgroup.h	blk-cgroup: Remove unused declaration blkg_path()	2024-08-16 15:07:27 -06:00
blk-core.c	block: add a rq_list type	2024-11-13 12:04:58 -07:00
blk-crypto-fallback.c	block: Rework bio_split() return value	2024-11-11 08:35:46 -07:00
blk-crypto-internal.h	blk-crypto: remove blk_crypto_insert_cloned_request()	2023-03-16 09:35:09 -06:00
blk-crypto-profile.c	blk-crypto: use dynamic lock class for blk_crypto_profile::lock	2023-07-05 16:36:12 -06:00
blk-crypto-sysfs.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
blk-crypto.c	blk-crypto: make blk_crypto_evict_key() more robust	2023-03-16 09:35:09 -06:00
blk-flush.c	for-6.11/block-20240710	2024-07-15 14:20:22 -07:00
blk-ia-ranges.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
blk-integrity.c	blk-integrity: remove seed for user mapped buffers	2024-10-30 07:49:32 -06:00
blk-ioc.c	block: replace call_rcu by kfree_rcu for simple kmem_cache_free callback	2024-10-22 08:16:40 -06:00
blk-iocost.c	blk_iocost: remove some duplicate irq disable/enables	2024-10-02 07:15:43 -06:00
blk-iolatency.c	block: add blk_time_get_ns() and blk_time_get() helpers	2024-02-05 10:07:22 -07:00
blk-ioprio.c	blk-ioprio: remove per-disk structure	2024-07-28 16:47:51 -06:00
blk-ioprio.h	blk-ioprio: remove per-disk structure	2024-07-28 16:47:51 -06:00
blk-lib.c	block: fix detection of unsupported WRITE SAME in blkdev_issue_write_zeroes	2024-08-28 08:49:25 -06:00
blk-map.c	block: don't free the integrity payload in bio_integrity_unmap_free_user	2024-07-03 10:21:16 -06:00
blk-merge.c	block: add a rq_list type	2024-11-13 12:04:58 -07:00
blk-mq-cpumap.c	blk-mq: include <linux/blk-mq.h> in block/blk-mq.h	2023-04-13 06:52:29 -06:00
blk-mq-debugfs.c	block: Catch possible entries missing from rqf_name[]	2024-07-19 09:32:49 -06:00
blk-mq-debugfs.h	block: Replace zone_wlock debugfs entry with zone_wplugs entry	2024-04-17 08:44:03 -06:00
blk-mq-pci.c	blk-mq: include <linux/blk-mq.h> in block/blk-mq.h	2023-04-13 06:52:29 -06:00
blk-mq-sched.c	blk-mq: Remove the hctx 'run' debugfs attribute	2024-01-17 14:16:34 -07:00
blk-mq-sched.h	blk-mq: make sure elevator callbacks aren't called for passthrough request	2023-05-18 19:42:54 -06:00
blk-mq-sysfs.c	blk-mq: include <linux/blk-mq.h> in block/blk-mq.h	2023-04-13 06:52:29 -06:00
blk-mq-tag.c	block: Fix lockdep warning in blk_mq_mark_tag_wait	2024-08-15 19:25:03 -06:00
blk-mq-virtio.c	blk-mq: include <linux/blk-mq.h> in block/blk-mq.h	2023-04-13 06:52:29 -06:00
blk-mq.c	block: don't reorder requests in blk_add_rq_to_plug	2024-11-13 12:04:58 -07:00
blk-mq.h	block: add a rq_list type	2024-11-13 12:04:58 -07:00
blk-pm.c	block: Remove blk_set_runtime_active()	2023-11-20 10:22:40 -07:00
blk-pm.h	block: Remove unused blk_pm_*() function definitions	2021-02-22 06:33:48 -07:00
blk-rq-qos.c	block: remove redundant explicit memory barrier from rq_qos waiter and waker	2024-10-22 14:05:09 -06:00
blk-rq-qos.h	block: skip QUEUE_FLAG_STATS and rq-qos for passthrough io	2023-12-01 18:29:18 -07:00
blk-settings.c	block: Support atomic writes limits for stacked devices	2024-11-19 10:30:02 -07:00
blk-stat.c	blk-throttle: remove CONFIG_BLK_DEV_THROTTLING_LOW	2024-05-09 09:44:55 -06:00
blk-stat.h	block: delete redundant function declaration	2024-05-27 13:58:06 -06:00
blk-sysfs.c	block: fix uaf for flush rq while iterating tags	2024-11-18 18:31:57 -07:00
blk-throttle.c	block: flush all throttled bios when deleting the cgroup	2024-10-22 08:16:43 -06:00
blk-throttle.h	blk-throttle: remove last_low_overflow_time	2024-09-10 16:31:41 -06:00
blk-timeout.c	block: blk-timeout: delete duplicated word	2020-07-31 16:29:47 -06:00
blk-wbt.c	blk-wbt: don't throttle swap writes in direct reclaim	2024-07-01 06:51:53 -06:00
blk-wbt.h	blk-wbt: remove the separate write cache tracking	2023-12-26 09:28:10 -07:00
blk-zoned.c	block: Add a public bdev_zone_is_seq() helper	2024-11-07 15:30:54 -07:00
blk.h	block: lift bio_is_zone_append to bio.h	2024-11-11 09:06:45 -07:00
bounce.c	block: split integrity support out of bio.h	2024-07-03 10:21:15 -06:00
bsg-lib.c	scsi: bsg: Pass dev to blk_mq_alloc_queue()	2024-05-30 20:22:15 -04:00
bsg.c	SCSI misc on 20230629	2023-06-30 11:57:07 -07:00
disk-events.c	block: move bdev_mark_dead out of disk_check_media_change	2023-10-28 13:29:23 +02:00
early-lookup.c	wrapper for access to ->bd_partno	2024-05-02 17:48:09 -04:00
elevator.c	block: don't verify IO lock for freeze/unfreeze in elevator_init_mq()	2024-11-07 16:27:22 -07:00
elevator.h	block: return void from the queue_sysfs_entry load_module method	2024-10-22 08:16:22 -06:00
fops.c	fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid()	2024-10-19 16:48:22 -06:00
genhd.c	block: fix uaf for flush rq while iterating tags	2024-11-18 18:31:57 -07:00
holder.c	block: fix deadlock between bd_link_disk_holder and partition scan	2024-02-23 07:44:19 -07:00
ioctl.c	block: implement async io_uring discard cmd	2024-09-11 10:45:28 -06:00
ioprio.c	block: move __get_task_ioprio() into header file	2024-01-08 12:27:39 -07:00
Kconfig	block: remove the blk_integrity_profile structure	2024-06-14 10:20:06 -06:00
Kconfig.iosched	block: Default to use cgroup support for BFQ	2023-01-30 09:42:42 -07:00
kyber-iosched.c	blk-mq: pass a flags argument to elevator_type->insert_requests	2023-04-13 06:52:30 -06:00
Makefile	block: remove the blk_integrity_profile structure	2024-06-14 10:20:06 -06:00
mq-deadline.c	block/mq-deadline: Fix the tag reservation code	2024-07-02 08:47:45 -06:00
opal_proto.h	block: sed-opal: handle empty atoms when parsing response	2024-02-16 15:52:45 -07:00
sed-opal.c	block: sed-opal: add ioctl IOC_OPAL_SET_SID_PW	2024-10-22 08:16:40 -06:00
t10-pi.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00