From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 9BEA680A50 for ; Tue, 13 Oct 2026 11:17:55 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69DBGimf012562; Tue, 13 Oct 2026 14:16:45 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69DBGimf012562 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="G13fSqjh" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69DBGD6h012470 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 13 Oct 2026 14:16:13 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69DBGD6h012470 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-487038bc9b8so2250812f8f.2 for ; Tue, 13 Oct 2026 04:16:13 -0700 (PDT) X-Gm-Message-State: AFq9FYKoMLHhr/9zSzFsgI3vRoZogxv7Mq5QFxg671rDyBSV3YEWWi60 Ptt1V/NZikIL4GohDzmxha74FgxRzu1okOJbnAvhANnJlZLlcf2JnvQOdgH1gyFWJT59RPEZaVq u0OWjFO5RwFciJWzfur0QLkqAbT+EZT+dyv2GjK6ptSf62poDP024Dw== X-Gm-Gg: AYBFou2H4moo+QbYtFxoYlr8P6G/Uw5wTO/TqdFtyU7m3ZrN28AOFVBmFaxMvgccsfj UWYw4E7pzn8U1LXNOskfLgspcmZRujlUoSUE24mEszLOb73V42Dtn+kDtPELN+wcE1Hdoh+7ewf 60RVJPJTgWUmVBAvtpYsiHlREBHXweLlC38UBiNsfpqrUx4qe8FyviH+WiVjPO4+4NpzquQ7Siu bkdm/eZJZaFTjlfb+1B/FH5PGhTkduANGps29Xwsy7jfwm9byRwF/dUepyNLNW2187FN/N4Mv9g snOIR3VnND0iHGv8LwltqHj0i1OIxglb95/j/e36tdWRIQSIsZKTSzuj7cpcFeovAJGGO1gVOdl iPByqgVglkHFEpdLSq3ghykHwKbA= X-Received: by 2002:a5d:448b:0:b0:48b:f9e2:4abb with SMTP id ffacd0b85a97d-48dbacfdd8bmr17439878f8f.57.1791890173423; Tue, 13 Oct 2026 04:16:13 -0700 (PDT) X-Received: by 2002:a5d:448b:0:b0:48b:f9e2:4abb with SMTP id ffacd0b85a97d-48dbacfdd8bmr17439809f8f.57.1791890172630; Tue, 13 Oct 2026 04:16:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791890172; cv=none; d=google.com; s=arc-20260327; b=YTSISfUcxAo0nVgWyTWUAqIHFwaEtRhhKCdGmwcGQUXP5dNKdmB1GbnTdMMNHPW96L HpT5zQelb3a5sg7w5qBgMODmPgoqqMFBrB0bf3B92E8KKiFCyTr+trMPt8cFxdTU/4rD EAHKC6gkuzMOylYR3cBG7SfRgJFGrxOrhLnYJO7DVERgStnzIXga1sTYDXHeAi4gbSWs Bc4uSo2Z6jdcgLHpTqomFgS0jHdgeeYR2+ffE24bb4vJcmpOqxucqI1lC3A94OtroIcQ QKA5rRlEv7ebYuDfmeFI8MEQumlF5GsUMF31Pe2ZxDY4+8RbzUOAwStiLFF/adOsIGTN R8+g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=vYUB3558eYfAGyboxCMtqMLNxtn9jRLx0LaQd9jaF7A=; fh=M+TyAUhAp4+t7uzAVeqNdLHW5eNz2FQXSv4TjrRhpCk=; b=E5db0qUth8m+0DIHiPUG/fum1jnlSzuEfZ5PQCSAhf1Oaksn3/TJgqFpAlZTDbGP5D InZobbkfktG8KPS1ncr66hJDAlp6idmfxMtJU0UNBJ0usdFM/43IcEdbx0vIGDX7CPP/ WGDdaorRIrnXZmC5ixKAy/wvCw8yoXyblNJNb68gyyvjhCjsHHeV5R8PDFMR1CVi+wFD Iog5QzZvZwn5Brg4scSTtKNMRBHqcpg9FCZY2F/8UyJec5/v6oHY3ZKJ0DstTwZK8/LG NYDdYFBVAjIZ9nxKgrDOcU5TOHF1aJqVVfn9RBw1m8b2tKZuwI5x1JMw505ArRym/kUz Jv7w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=G13fSqjh; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48de0bf6c52si4790645f8f.318.2026.10.13.04.16.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 04:16:12 -0700 (PDT) Received-SPF: pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=G13fSqjh; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=vYUB3558eYfAGyboxCMtqMLNxtn9jRLx0LaQd9jaF7A=; b=G13fSqjhUYoj qFh5hBUUE8fOpYy6oqkPH29SNCa3DpJsRhzm4BtIUlCD6AO4tHue4hW9rHkLBbevDP5H7eYW9BE60 aOJGSIisLro6yuFb8bpHqF8dghsHZqsU+uClBXD2MhKQbXUl42MPqV0vLmQP10kqoKU1Rl/1KUjNd Q2Jg7J27c4i1s8Lwn2r8ByD+AucdhH34nYPUdVQC3NsweX1OLtgfjVhx2Vg09IH6te5wgh1riTAHT PNRuZf3yAUiM3jD7vmxTJ6XugVvOtcuKPhRsN+s1UAzIZySrbeSpMArhqrH08S48/MQC2By2FL5Uq cZLranP/CxC5XD7aCpgIkQ==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=sky) by relay.virtuozzo.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xGaQy-008pMQ-2Y; Tue, 13 Oct 2026 13:16:02 +0200 From: Alexander Ivanov To: den@openvz.org Date: Tue, 13 Oct 2026 13:16:01 +0200 Message-ID: <20261013111604.142989-10-alexander.ivanov@virtuozzo.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261013111604.142989-1-alexander.ivanov@virtuozzo.com> References: <20261013111604.142989-1-alexander.ivanov@virtuozzo.com> MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v6 09/12] dm-ploop: fix use-after-free on the last inflight_md decrement X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org The last piwb reference is often dropped from the BAT write completion in aio context. ploop_bat_write_finish() completes the data pios there, and once the last original request is done, suspend can finish and a table reload or remove can free the ploop in ploop_destroy(). The completing CPU still decrements inflight_md, calls wake_up() on inflight_md_wq and frees the piwb into ploop->pio_pool, so it can lock a freed waitqueue or free into a destroyed mempool. Nothing on the suspend or destroy path waits for inflight_md, and the one waiter that exists, ploop_suspend_submitting_pios(), checks the counter without a lock. It can see zero and return before wake_up() and ploop_free_piwb() are done with the ploop, so the message can finish and the table can be destroyed under the waker. Free the piwb first, then decrement inflight_md and wake the waiters under inflight_md_wq.lock as the last access to the ploop. Have the waiters take the same lock once they see zero, so they cannot proceed until the waker has released it, and wait for it in ploop_destroy() before freeing anything. https://virtuozzo.atlassian.net/browse/VSTOR-148171 Feature: dm-ploop: ploop target driver Signed-off-by: Alexander Ivanov --- drivers/md/dm-ploop-cmd.c | 6 ++++-- drivers/md/dm-ploop-map.c | 22 ++++++++++++++++++---- drivers/md/dm-ploop-target.c | 7 +++++++ 3 files changed, 29 insertions(+), 6 deletions(-) diff --git a/drivers/md/dm-ploop-cmd.c b/drivers/md/dm-ploop-cmd.c index ab17520c2d56..977b6920a5b4 100644 --- a/drivers/md/dm-ploop-cmd.c +++ b/drivers/md/dm-ploop-cmd.c @@ -154,8 +154,10 @@ static int ploop_suspend_submitting_pios(struct ploop *ploop) if (ret) goto out; - ret = wait_event_interruptible(ploop->inflight_md_wq, - !atomic_read(&ploop->inflight_md)); + spin_lock_irq(&ploop->inflight_md_wq.lock); + ret = wait_event_interruptible_locked_irq(ploop->inflight_md_wq, + !atomic_read(&ploop->inflight_md)); + spin_unlock_irq(&ploop->inflight_md_wq.lock); out: if (ret) ploop_resume_submitting_pios(ploop); diff --git a/drivers/md/dm-ploop-map.c b/drivers/md/dm-ploop-map.c index c313f303fff9..e2b70cb3c142 100644 --- a/drivers/md/dm-ploop-map.c +++ b/drivers/md/dm-ploop-map.c @@ -909,9 +909,25 @@ static void ploop_free_piwb(struct ploop_index_wb *piwb) static void ploop_bat_write_finish(struct pio *pio, void *piwb_ptr, blk_status_t bi_status); +/* + * Waiters do not act on zero inflight_md without holding inflight_md_wq.lock, + * so the ploop stays valid while we hold it. Once we drop it, the ploop may + * be freed, so this must be the last access to it. + */ +static void ploop_dec_inflight_md(struct ploop *ploop) +{ + unsigned long flags; + + spin_lock_irqsave(&ploop->inflight_md_wq.lock, flags); + if (atomic_dec_and_test(&ploop->inflight_md)) + wake_up_locked(&ploop->inflight_md_wq); + spin_unlock_irqrestore(&ploop->inflight_md_wq.lock, flags); +} + static void ploop_put_piwb(struct ploop_index_wb *piwb) { if (atomic_dec_and_test(&piwb->count)) { + struct ploop *ploop = piwb->ploop; ploop_bat_write_finish(piwb->pio, piwb, piwb->bi_status); @@ -925,9 +941,8 @@ static void ploop_put_piwb(struct ploop_index_wb *piwb) * zero keeps it as is */ - if (atomic_dec_and_test(&piwb->ploop->inflight_md)) - wake_up(&piwb->ploop->inflight_md_wq); ploop_free_piwb(piwb); + ploop_dec_inflight_md(ploop); } } @@ -1105,9 +1120,8 @@ void ploop_break_bat_update(struct ploop *ploop, struct md_page *md, spin_unlock(&md->md_lock); spin_unlock_irqrestore(&ploop->bat_lock, flags); - if (atomic_dec_and_test(&ploop->inflight_md)) - wake_up(&ploop->inflight_md_wq); ploop_free_piwb(piwb); + ploop_dec_inflight_md(ploop); } static void ploop_bat_page_zero_cluster(struct ploop *ploop, diff --git a/drivers/md/dm-ploop-target.c b/drivers/md/dm-ploop-target.c index 3b589579741c..dc9410212831 100644 --- a/drivers/md/dm-ploop-target.c +++ b/drivers/md/dm-ploop-target.c @@ -192,6 +192,13 @@ static void ploop_destroy(struct ploop *ploop) if (ploop->kt_allocator) kthread_stop(ploop->kt_allocator->task); + /* BAT writes may still be completing from aio context */ + wait_event(ploop->inflight_md_wq, + !atomic_read(&ploop->inflight_md)); + /* Wait for ploop_dec_inflight_md() to drop the lock */ + spin_lock_irq(&ploop->inflight_md_wq.lock); + spin_unlock_irq(&ploop->inflight_md_wq.lock); + WARN_ON(!llist_empty(&ploop->pios[PLOOP_LIST_PREPARE])); WARN_ON(!llist_empty(&ploop->llresubmit_pios)); WARN_ON(!llist_empty(&ploop->enospc_pios)); -- 2.53.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel