xen-blkfront: fix double completion of split requests on resume#1034
Open
blktests-ci[bot] wants to merge 1 commit into
Open
xen-blkfront: fix double completion of split requests on resume#1034blktests-ci[bot] wants to merge 1 commit into
blktests-ci[bot] wants to merge 1 commit into
Conversation
When a block request is too large for a single ring entry and the backend does not support indirect descriptors, blkfront splits it across two ring requests. blkif_ring_get_request() is called twice and both shadow slots (shadow[id] and shadow[extra_id]) are made to point at the *same* struct request, linked together through associated_id. On the normal completion path blkif_completion() collapses the pair: it recycles the second slot via add_id_to_freelist() and only completes the request once. The suspend/resume path in blkfront_resume() does not. It walks every physical shadow slot and, for each slot whose ->request is set, calls blk_mq_end_request() or re-queues ->request. For an in-flight split request this visits the shared struct request twice, so on resume/migration the same request is ended (or re-queued) two times. The second visit is a double blk_mq_end_request() (refcount underflow / double free) and a use-after-free read of req->bio, which was cleared on the first visit. Skip the secondary slot of a split request in the resume walk, so each logical request is completed or re-queued exactly once, matching how blkif_completion() already treats the pair. The secondary slot is the one that is linked (associated_id != NO_ASSOCIATED_ID) and carries no scatter-gather list (num_sg == 0); the first slot always keeps the scatter-gather list. This was found by 0sec automated security-research tooling (https://0sec.ai). The bug is only reachable on suspend/resume or live migration of a guest whose backend lacks indirect-descriptor support, so it has no local reproducer; the fix is by source inspection against the existing blkif_completion() collapse logic. Fixes: 6cc5683 ("xen/blkfront: Handle non-indirect grant with 64KB pages") Assisted-by: 0sec:claude-opus-4-8 Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
Author
|
Upstream branch: 87320be |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request for series with
subject: xen-blkfront: fix double completion of split requests on resume
version: 1
url: https://patchwork.kernel.org/project/linux-block/list/?series=1121767