From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id D321580726 for ; Mon, 12 Oct 2026 13:28:38 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69CDROVN022940; Mon, 12 Oct 2026 16:27:25 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69CDROVN022940 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="rg/Hgj4l" Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69CDQumT022865 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 12 Oct 2026 16:26:56 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69CDQumT022865 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-4a01c621dc2so14106215e9.2 for ; Mon, 12 Oct 2026 06:26:56 -0700 (PDT) X-Gm-Message-State: AFq9FYJCHoGyBleerE4DMeHcQ1+b8IQGFA/yYCYmlBcxGyfzNrwkqshG 6NBBVsM5PQqCriOAppQg1xTB55mPx/PJ18K7lhfkRio3yQz4JBeRNfr2d0RuCP2w2qtfqp/g3dd 4530YUbmp5ypUuKPlsWyve1iKQEsDk3t+ZmOc/z3cVraqlQpMgLUvFA== X-Gm-Gg: AYBFou2/fVTyCpFugXMhZSdx6ToBLZy0GIn6xMH1CVHdM1+JQ/Cu3DUFKUt9FAyH0kR r6jXOh3UieTHrTYtqWRmLdN/cxA0VS99J+YuGhloajtlapEpOSceq2lTp9oK2iPRbhiYzwDygRd uHnDF4fO5tUTOl9zBeFADMQyLYrghGpVi3uB8YfjZ/YTBLpLU7lOgsjhK8kQkQvppMYlyRERexP yx2BFkqnyp64ExLPnYx/qFCNNxVpNZbkXs8gfiYtHwdXWEUjTH4ClEc8cWkNmXXb1mF/bGVrJdl 0a3EpnoIMHscdWJG/TQvtQxFhE5I4bUIeaGlFxC+gJeQwFisX7zD4OX/uQbrC1KcKIxoZazxMov jirG0fMAceb6l6huGnXiFu9YIBlgw X-Received: by 2002:a05:600c:8218:b0:49f:ffdc:939d with SMTP id 5b1f17b1804b1-4a18e49d9f5mr175808165e9.9.1791811616272; Mon, 12 Oct 2026 06:26:56 -0700 (PDT) X-Received: by 2002:a05:600c:8218:b0:49f:ffdc:939d with SMTP id 5b1f17b1804b1-4a18e49d9f5mr175807305e9.9.1791811615611; Mon, 12 Oct 2026 06:26:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791811615; cv=none; d=google.com; s=arc-20260327; b=s/f2CXqB02f11hqIQUm2KlifnmGZ4sCCuMG5R7C2p2M2AUvaXgejgCy0AVecZaIDbH fy71Ih4cAn4u3/470/3TiqqnQFfIGVTM/ECyXd1g3yYKVTnbNVS2GxAhoBbuTz5kDj3W 4U3Kr43JOt0BruORZqqWNCt4v4dyOnhn1kVvjrrLIsEhcBJDkqpeUpkXNJkGmcIfZ384 Ah3ffzPbShQMda7A/XYZMZcy2+4Z6MKfZsN2ot7DfeXAz/3L5oPHvkRa9+np8N1hkCeD dcrKX5VjKTHophsBdTdEywUwCg/l2l+VUlL/QfFMTUU/JBBPmn0YBg8BSijlEo6TFV+4 1gGw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=F3sZN9BKTYkgj8Nwt2ql1iSpu5LXg5ZRUeIEN5GXiJU=; fh=M+TyAUhAp4+t7uzAVeqNdLHW5eNz2FQXSv4TjrRhpCk=; b=FQotqxODpcGhbxixd2HrTG2wVI2Nr1VeKUJ0gwE112CnU6PN+C+MFpy1IgtiQer2Cz 4I8/LcYFyCD3j+BYgRDBC122Q0V130nKjTYjyCnzB/PEKw9CLF8WYbQI2eYQjzTsKVHV KNNjcVkUUhoVmoTI7q+UvTUD+XurfAtE4Z7azFB97LQ2o70ts6iqib1IdC41bEphlHrT XUcIL+LSPnG2GQwQny573Q41Bx9YTrDolUZRTTF4dhTEWOEFaESleEliSPFY5BQuahGG EyS2iPdeQ3n5qamAwXW0zLbsoUB+6KesCx0LGnSS2tuGNYpTLNoC42n+vfk9tWXTk90U VkCw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b="rg/Hgj4l"; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48db9ac6859si17846951f8f.232.2026.10.12.06.26.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 06:26:55 -0700 (PDT) Received-SPF: pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b="rg/Hgj4l"; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=F3sZN9BKTYkgj8Nwt2ql1iSpu5LXg5ZRUeIEN5GXiJU=; b=rg/Hgj4l2nqg OU14k1aI/Dp/mQ7Vld8BIGN3CgIB4NspdABMhmMKXbbtx5wjpWY289iZrQsMP3HkHc62hTJ4JPqzH msr93D0PMDWxQCkYpyBVr7ab2KROIJX3v+zL1nt8ETXqvbviMmbeojILphOSFYNZ51zIf4E4sEhTx jZKRO0G5oZDmzF4knYJLwgwnR4qB3+VMJ+YGx+cTWjjK8iizpRpdhthbKGF35F7FrGLVOSSIjZmCy nGovQEyQ/ZghIT/ETWfD0j9Xqw9tPTMF03nGxKhAHlbGxQZOYF1Q9iObYuuaFZ25W1AkgbYaHKZ2U jzDoO/uLu6CtI1xL688C9A==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=sky) by relay.virtuozzo.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xGFzx-001WAY-0c; Mon, 12 Oct 2026 15:26:46 +0200 From: Alexander Ivanov To: den@openvz.org Date: Mon, 12 Oct 2026 15:26:44 +0200 Message-ID: <20261012132646.41494-10-alexander.ivanov@virtuozzo.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261012132646.41494-1-alexander.ivanov@virtuozzo.com> References: <20261012132646.41494-1-alexander.ivanov@virtuozzo.com> MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v4 09/11] dm-ploop: fix use-after-free on the last inflight_md decrement X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org The last piwb reference is often dropped from the BAT write completion in aio context. ploop_bat_write_finish() completes the data pios there, and once the last original request is done, suspend can finish and a table reload or remove can free the ploop in ploop_destroy(). The completing CPU still decrements inflight_md, calls wake_up() on inflight_md_wq and frees the piwb into ploop->pio_pool, so it can lock a freed waitqueue or free into a destroyed mempool. Nothing on the suspend or destroy path waits for inflight_md, and the one waiter that exists, ploop_suspend_submitting_pios(), checks the counter without a lock. It can see zero and return before wake_up() and ploop_free_piwb() are done with the ploop, so the message can finish and the table can be destroyed under the waker. Free the piwb first, then decrement inflight_md and wake the waiters under inflight_md_wq.lock as the last access to the ploop. Have the waiters check the counter under the same lock, so they cannot see zero until the waker has released it, and wait for it in ploop_destroy() before freeing anything. https://virtuozzo.atlassian.net/browse/VSTOR-148171 Feature: dm-ploop: ploop target driver Signed-off-by: Alexander Ivanov --- drivers/md/dm-ploop-cmd.c | 6 ++++-- drivers/md/dm-ploop-map.c | 22 ++++++++++++++++++---- drivers/md/dm-ploop-target.c | 7 +++++++ 3 files changed, 29 insertions(+), 6 deletions(-) diff --git a/drivers/md/dm-ploop-cmd.c b/drivers/md/dm-ploop-cmd.c index ab17520c2d56..977b6920a5b4 100644 --- a/drivers/md/dm-ploop-cmd.c +++ b/drivers/md/dm-ploop-cmd.c @@ -154,8 +154,10 @@ static int ploop_suspend_submitting_pios(struct ploop *ploop) if (ret) goto out; - ret = wait_event_interruptible(ploop->inflight_md_wq, - !atomic_read(&ploop->inflight_md)); + spin_lock_irq(&ploop->inflight_md_wq.lock); + ret = wait_event_interruptible_locked_irq(ploop->inflight_md_wq, + !atomic_read(&ploop->inflight_md)); + spin_unlock_irq(&ploop->inflight_md_wq.lock); out: if (ret) ploop_resume_submitting_pios(ploop); diff --git a/drivers/md/dm-ploop-map.c b/drivers/md/dm-ploop-map.c index c313f303fff9..f673e94d0e38 100644 --- a/drivers/md/dm-ploop-map.c +++ b/drivers/md/dm-ploop-map.c @@ -909,9 +909,25 @@ static void ploop_free_piwb(struct ploop_index_wb *piwb) static void ploop_bat_write_finish(struct pio *pio, void *piwb_ptr, blk_status_t bi_status); +/* + * Waiters check inflight_md under inflight_md_wq.lock, so they cannot see + * zero while we still hold it. Once it is zero, the ploop may be freed, so + * this must be the last access to it. + */ +static void ploop_dec_inflight_md(struct ploop *ploop) +{ + unsigned long flags; + + spin_lock_irqsave(&ploop->inflight_md_wq.lock, flags); + if (atomic_dec_and_test(&ploop->inflight_md)) + wake_up_locked(&ploop->inflight_md_wq); + spin_unlock_irqrestore(&ploop->inflight_md_wq.lock, flags); +} + static void ploop_put_piwb(struct ploop_index_wb *piwb) { if (atomic_dec_and_test(&piwb->count)) { + struct ploop *ploop = piwb->ploop; ploop_bat_write_finish(piwb->pio, piwb, piwb->bi_status); @@ -925,9 +941,8 @@ static void ploop_put_piwb(struct ploop_index_wb *piwb) * zero keeps it as is */ - if (atomic_dec_and_test(&piwb->ploop->inflight_md)) - wake_up(&piwb->ploop->inflight_md_wq); ploop_free_piwb(piwb); + ploop_dec_inflight_md(ploop); } } @@ -1105,9 +1120,8 @@ void ploop_break_bat_update(struct ploop *ploop, struct md_page *md, spin_unlock(&md->md_lock); spin_unlock_irqrestore(&ploop->bat_lock, flags); - if (atomic_dec_and_test(&ploop->inflight_md)) - wake_up(&ploop->inflight_md_wq); ploop_free_piwb(piwb); + ploop_dec_inflight_md(ploop); } static void ploop_bat_page_zero_cluster(struct ploop *ploop, diff --git a/drivers/md/dm-ploop-target.c b/drivers/md/dm-ploop-target.c index 3b589579741c..11d25277d60c 100644 --- a/drivers/md/dm-ploop-target.c +++ b/drivers/md/dm-ploop-target.c @@ -192,6 +192,13 @@ static void ploop_destroy(struct ploop *ploop) if (ploop->kt_allocator) kthread_stop(ploop->kt_allocator->task); + /* BAT writes may still be completing from aio context */ + spin_lock_irq(&ploop->inflight_md_wq.lock); + wait_event_lock_irq(ploop->inflight_md_wq, + !atomic_read(&ploop->inflight_md), + ploop->inflight_md_wq.lock); + spin_unlock_irq(&ploop->inflight_md_wq.lock); + WARN_ON(!llist_empty(&ploop->pios[PLOOP_LIST_PREPARE])); WARN_ON(!llist_empty(&ploop->llresubmit_pios)); WARN_ON(!llist_empty(&ploop->enospc_pios)); -- 2.53.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel