• Dave Chinner's avatar
    xfs: fix use-after-free on CIL context on shutdown · c7f87f39
    Dave Chinner authored
    xlog_wait() on the CIL context can reference a freed context if the
    waiter doesn't get scheduled before the CIL context is freed. This
    can happen when a task is on the hard throttle and the CIL push
    aborts due to a shutdown. This was detected by generic/019:
    
    thread 1			thread 2
    
    __xfs_trans_commit
     xfs_log_commit_cil
      <CIL size over hard throttle limit>
      xlog_wait
       schedule
    				xlog_cil_push_work
    				wake_up_all
    				<shutdown aborts commit>
    				xlog_cil_committed
    				kmem_free
    
       remove_wait_queue
        spin_lock_irqsave --> UAF
    
    Fix it by moving the wait queue to the CIL rather than keeping it in
    in the CIL context that gets freed on push completion. Because the
    wait queue is now independent of the CIL context and we might have
    multiple contexts in flight at once, only wake the waiters on the
    push throttle when the context we are pushing is over the hard
    throttle size threshold.
    
    Fixes: 0e7ab7ef ("xfs: Throttle commits on delayed background CIL push")
    Reported-by: default avatarYu Kuai <yukuai3@huawei.com>
    Signed-off-by: default avatarDave Chinner <dchinner@redhat.com>
    Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
    Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
    Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
    c7f87f39
xfs_log_cil.c 38.1 KB