From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 836FC8017D for ; Tue, 13 Oct 2026 07:57:05 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69D7trJ1010036; Tue, 13 Oct 2026 10:55:54 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69D7trJ1010036 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="WlQI0/uE" Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69D7tSKP009960 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 13 Oct 2026 10:55:28 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69D7tSKP009960 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-48b02e93a1eso2018824f8f.1 for ; Tue, 13 Oct 2026 00:55:28 -0700 (PDT) X-Gm-Message-State: AFq9FYIplq0445QSFeFCq8CWs43dczQfH+ir1ieefFKLgzlJcFBhryvS f0f/t81tl6xc49M6vZco5pg0p3U98lOogv784LgbIZCmllABjnqj9PQB03DNWipidKVXUNqJuWb JXztcRHyIXK9yO50SI8HdSoNR5+mH6jIOaFwbfa2TZaUqLg+pAWGQDw== X-Gm-Gg: AYBFou1v7UgpoDscCY6Ek6Ap0IOKfX2m/1pbiRaCZhHhTTq0vNe1KFohNcnTb3QTon0 PmyBI3C/vMSij58Tx0DGeE15bk+vWihMkiZeNOYQfyh7bq1a08+eAazLnS0R2kshLKThvPfx5i8 2HKZNXctPZtGpSLO0UlpYqnjWsn6+jWJPzySLgv7u3q6c8/Dbu9XUv+L6ffPy/VEV8tkQmllq/F ZVp6qECL3bBH2mXJYGkg79TKv/lY//xwifcqO7tSvXzWe51Z90V4kpEcvb0a/xdSikZteVXVe7z rzQq6pgH8wu6ZIqsHyidde+mbA/X2cQ+wbVcr8fb1IqYEJUQNHpWXgvxJujKaur7jqlXXfzp9ig XpSg1R8o9Gqc3zTJwv3HFKZdvapk= X-Received: by 2002:adf:e8c9:0:b0:48b:2a2:31dc with SMTP id ffacd0b85a97d-48dbaceba4dmr18366652f8f.49.1791878128400; Tue, 13 Oct 2026 00:55:28 -0700 (PDT) X-Received: by 2002:adf:e8c9:0:b0:48b:2a2:31dc with SMTP id ffacd0b85a97d-48dbaceba4dmr18366623f8f.49.1791878127840; Tue, 13 Oct 2026 00:55:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791878127; cv=none; d=google.com; s=arc-20260327; b=Jn+Bn3BIo8dkieL1qtn6r2pcE+ALFmSlY2N6LInF/l+laPit0BE+HPBXQjnqTE2cf1 S+i6bdiZn6ewswNCIfBD+Rxa/Op9R+8ZLFsXCpXYGvmqmEHCyqfZB7iDruJCTtxcvr5Q CKhfMUg98GKBoykTbL/Xw529NSmCESLJOkbnX/7hNXHu9gR9sZ4s2Jc2gq3UEuD4K53m eHBsn1t/l1G92bD9inGpIaQZqMVaKj6CJcjMuUJ19lpVHvmzx4VYejhrL+FY1gp3XNI6 wh+LqQz+cpQ/QxKK/vsf/knVaOTdPki64Oe0IxSVPdjGN4f7xFruIFhZvD6rop3TcQZB btNg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=vYUB3558eYfAGyboxCMtqMLNxtn9jRLx0LaQd9jaF7A=; fh=M+TyAUhAp4+t7uzAVeqNdLHW5eNz2FQXSv4TjrRhpCk=; b=ixLVwKuupjEqeYUqCRYVVKLbjVy1iUie306OFVt8LpSimwtZOT6qHLpNc5VWMjhse9 srF6fU3hf7m681058lORtYVANBTBtd6E9EMXpag2ouTfRHBoDox0zrw9d1Wlpu+8JRr7 rEA3eNXie2y+D5fZ+yauBGBDlIb8hSycYFqCR2ZcQiUZtr03JmUR+hFsofGqd7JS+pTf e2mU5T6Pw/mMuVKF0dqtBEZA2cLtfmPy+0LzV3xlZzhxRVCMUk/aD89TyL4A5iqQbW3/ 4wioSZ8LWRoCYBfzAj0f98CCtId41k6D9w67lMD3pvVvHnNAPB2f/QhMzJa5bXkm/hng JAfQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b="WlQI0/uE"; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48de0ac8298si3851605f8f.127.2026.10.13.00.55.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 00:55:27 -0700 (PDT) Received-SPF: pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b="WlQI0/uE"; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=vYUB3558eYfAGyboxCMtqMLNxtn9jRLx0LaQd9jaF7A=; b=WlQI0/uEEHWw 3bEWAFQVlLwFaRjtcl8IomfxYANUhaUsR6EGwIacCUZltzjsxTOXDZnNFDV17gzbHg/RjipMjo/fn WYzaf72ubsntQmdgJ25R0HAxRLYHUIPYV2Et4aQz9lvbT6xfL70qiOBSyd2+UC3HizAdUvGga+2oD FJFxX1oEqi+AyGgMAN6DZ5D+HQc9nI9pbnXqdCJcLSh5xSqg4os/LYM+u3aZnAaQcrYOok4+wvxPV ulAk5m97EZJ3P/DG2QhSwCTFdXJIWEuLBXZUj3W5Ypv6nP/UUd5+mzVatQAOP5NSS29zIOoOvwpcG rMjghxBkpzvBxtIcxAcipQ==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=sky) by relay.virtuozzo.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xGXIi-004zlI-0X; Tue, 13 Oct 2026 09:55:17 +0200 From: Alexander Ivanov To: den@openvz.org Date: Tue, 13 Oct 2026 09:55:11 +0200 Message-ID: <20261013075513.90618-10-alexander.ivanov@virtuozzo.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261013075513.90618-1-alexander.ivanov@virtuozzo.com> References: <20261013075513.90618-1-alexander.ivanov@virtuozzo.com> MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v5 09/11] dm-ploop: fix use-after-free on the last inflight_md decrement X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org The last piwb reference is often dropped from the BAT write completion in aio context. ploop_bat_write_finish() completes the data pios there, and once the last original request is done, suspend can finish and a table reload or remove can free the ploop in ploop_destroy(). The completing CPU still decrements inflight_md, calls wake_up() on inflight_md_wq and frees the piwb into ploop->pio_pool, so it can lock a freed waitqueue or free into a destroyed mempool. Nothing on the suspend or destroy path waits for inflight_md, and the one waiter that exists, ploop_suspend_submitting_pios(), checks the counter without a lock. It can see zero and return before wake_up() and ploop_free_piwb() are done with the ploop, so the message can finish and the table can be destroyed under the waker. Free the piwb first, then decrement inflight_md and wake the waiters under inflight_md_wq.lock as the last access to the ploop. Have the waiters take the same lock once they see zero, so they cannot proceed until the waker has released it, and wait for it in ploop_destroy() before freeing anything. https://virtuozzo.atlassian.net/browse/VSTOR-148171 Feature: dm-ploop: ploop target driver Signed-off-by: Alexander Ivanov --- drivers/md/dm-ploop-cmd.c | 6 ++++-- drivers/md/dm-ploop-map.c | 22 ++++++++++++++++++---- drivers/md/dm-ploop-target.c | 7 +++++++ 3 files changed, 29 insertions(+), 6 deletions(-) diff --git a/drivers/md/dm-ploop-cmd.c b/drivers/md/dm-ploop-cmd.c index ab17520c2d56..977b6920a5b4 100644 --- a/drivers/md/dm-ploop-cmd.c +++ b/drivers/md/dm-ploop-cmd.c @@ -154,8 +154,10 @@ static int ploop_suspend_submitting_pios(struct ploop *ploop) if (ret) goto out; - ret = wait_event_interruptible(ploop->inflight_md_wq, - !atomic_read(&ploop->inflight_md)); + spin_lock_irq(&ploop->inflight_md_wq.lock); + ret = wait_event_interruptible_locked_irq(ploop->inflight_md_wq, + !atomic_read(&ploop->inflight_md)); + spin_unlock_irq(&ploop->inflight_md_wq.lock); out: if (ret) ploop_resume_submitting_pios(ploop); diff --git a/drivers/md/dm-ploop-map.c b/drivers/md/dm-ploop-map.c index c313f303fff9..e2b70cb3c142 100644 --- a/drivers/md/dm-ploop-map.c +++ b/drivers/md/dm-ploop-map.c @@ -909,9 +909,25 @@ static void ploop_free_piwb(struct ploop_index_wb *piwb) static void ploop_bat_write_finish(struct pio *pio, void *piwb_ptr, blk_status_t bi_status); +/* + * Waiters do not act on zero inflight_md without holding inflight_md_wq.lock, + * so the ploop stays valid while we hold it. Once we drop it, the ploop may + * be freed, so this must be the last access to it. + */ +static void ploop_dec_inflight_md(struct ploop *ploop) +{ + unsigned long flags; + + spin_lock_irqsave(&ploop->inflight_md_wq.lock, flags); + if (atomic_dec_and_test(&ploop->inflight_md)) + wake_up_locked(&ploop->inflight_md_wq); + spin_unlock_irqrestore(&ploop->inflight_md_wq.lock, flags); +} + static void ploop_put_piwb(struct ploop_index_wb *piwb) { if (atomic_dec_and_test(&piwb->count)) { + struct ploop *ploop = piwb->ploop; ploop_bat_write_finish(piwb->pio, piwb, piwb->bi_status); @@ -925,9 +941,8 @@ static void ploop_put_piwb(struct ploop_index_wb *piwb) * zero keeps it as is */ - if (atomic_dec_and_test(&piwb->ploop->inflight_md)) - wake_up(&piwb->ploop->inflight_md_wq); ploop_free_piwb(piwb); + ploop_dec_inflight_md(ploop); } } @@ -1105,9 +1120,8 @@ void ploop_break_bat_update(struct ploop *ploop, struct md_page *md, spin_unlock(&md->md_lock); spin_unlock_irqrestore(&ploop->bat_lock, flags); - if (atomic_dec_and_test(&ploop->inflight_md)) - wake_up(&ploop->inflight_md_wq); ploop_free_piwb(piwb); + ploop_dec_inflight_md(ploop); } static void ploop_bat_page_zero_cluster(struct ploop *ploop, diff --git a/drivers/md/dm-ploop-target.c b/drivers/md/dm-ploop-target.c index 3b589579741c..dc9410212831 100644 --- a/drivers/md/dm-ploop-target.c +++ b/drivers/md/dm-ploop-target.c @@ -192,6 +192,13 @@ static void ploop_destroy(struct ploop *ploop) if (ploop->kt_allocator) kthread_stop(ploop->kt_allocator->task); + /* BAT writes may still be completing from aio context */ + wait_event(ploop->inflight_md_wq, + !atomic_read(&ploop->inflight_md)); + /* Wait for ploop_dec_inflight_md() to drop the lock */ + spin_lock_irq(&ploop->inflight_md_wq.lock); + spin_unlock_irq(&ploop->inflight_md_wq.lock); + WARN_ON(!llist_empty(&ploop->pios[PLOOP_LIST_PREPARE])); WARN_ON(!llist_empty(&ploop->llresubmit_pios)); WARN_ON(!llist_empty(&ploop->enospc_pios)); -- 2.53.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel