Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-10 14:11:52 +00:00
Code Issues Packages Projects Releases Wiki Activity
d71e38df3b
linux/block
History
Yu Kuai e2f2a39452 block, bfq: fix uaf for 'stable_merge_bfqq' 
Before commit fd571df0ac ("block, bfq: turn bfqq_data into an array
in bfq_io_cq"), process reference is read before bfq_put_stable_ref(),
and it's safe if bfq_put_stable_ref() put the last reference, because
process reference will be 0 and 'stable_merge_bfqq' won't be accessed
in this case. However, the commit changed the order and  will cause
uaf for 'stable_merge_bfqq'.

In order to emphasize that bfq_put_stable_ref() can drop the last
reference, fix the problem by moving bfq_put_stable_ref() to the end of
bfq_setup_stable_merge().

Fixes: fd571df0ac ("block, bfq: turn bfqq_data into an array in bfq_io_cq")
Reported-and-tested-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Link: https://lore.kernel.org/linux-block/20230307071448.rzihxbm4jhbf5krj@shindev/
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2023-03-08 07:34:50 -07:00
..
partitions driver core: make struct device_type.uevent() take a const * 2023-01-27 13:45:36 +01:00
badblocks.c block/badblocks: Remove redundant assignments 2022-04-23 07:15:26 -06:00
bdev.c block: remove ->rw_page 2023-02-02 22:33:34 -08:00
bfq-cgroup.c for-6.3/block-2023-02-16 2023-02-20 14:27:21 -08:00
bfq-iosched.c block, bfq: fix uaf for 'stable_merge_bfqq' 2023-03-08 07:34:50 -07:00
bfq-iosched.h block, bfq: cleanup 'bfqg->online' 2023-02-07 10:20:59 -07:00
bfq-wf2q.c block, bfq: inject I/O to underutilized actuators 2023-01-29 15:18:33 -07:00
bio-integrity.c block: bio-integrity: Copy flags when bio_integrity_payload is cloned 2023-02-16 11:05:41 -07:00
bio.c block-6.3-2023-03-03 2023-03-03 10:21:39 -08:00
blk-cgroup-fc-appid.c cgroup: Homogenize cgroup_get_from_id() return value 2022-08-26 10:57:41 -10:00
blk-cgroup-rwstat.c Revert "blk-cgroup: pin the gendisk in struct blkcg_gq" 2023-02-14 14:24:09 -07:00
blk-cgroup-rwstat.h block: Use the new blk_opf_t type 2022-07-14 12:14:30 -06:00
blk-cgroup.c for-6.3/block-2023-02-16 2023-02-20 14:27:21 -08:00
blk-cgroup.h Revert "blk-cgroup: pin the gendisk in struct blkcg_gq" 2023-02-14 14:24:09 -07:00
blk-core.c block-6.3-2023-03-03 2023-03-03 10:21:39 -08:00
blk-crypto-fallback.c treewide: use get_random_bytes() when possible 2022-10-11 17:42:58 -06:00
blk-crypto-internal.h blk-crypto: pass a gendisk to blk_crypto_sysfs_{,un}register 2022-11-30 11:09:00 -07:00
blk-crypto-profile.c blk-crypto: Add a missing include directive 2022-11-23 10:38:54 -07:00
blk-crypto-sysfs.c block: make kobj_type structures constant 2023-02-09 09:38:16 -07:00
blk-crypto.c for-6.2/block-2022-12-08 2022-12-13 10:43:59 -08:00
blk-flush.c block: change request end_io handler to pass back a return value 2022-09-30 07:49:09 -06:00
blk-ia-ranges.c block: make kobj_type structures constant 2023-02-09 09:38:16 -07:00
blk-integrity.c block: make kobj_type structures constant 2023-02-09 09:38:16 -07:00
blk-ioc.c block: fix default IO priority handling again 2022-06-27 06:29:12 -06:00
blk-iocost.c blk-iocost: Pass gendisk to ioc_refresh_params 2023-02-28 05:51:19 -07:00
blk-iolatency.c Revert "blk-cgroup: pin the gendisk in struct blkcg_gq" 2023-02-14 14:24:09 -07:00
blk-ioprio.c blk-cgroup: pass a gendisk to pd_alloc_fn 2023-02-03 08:20:05 -07:00
blk-ioprio.h blk-ioprio: pass a gendisk to blk_ioprio_init and blk_ioprio_exit 2022-09-26 19:09:31 -06:00
blk-lib.c blk-lib: fix blkdev_issue_secure_erase 2022-09-15 00:25:17 -06:00
blk-map.c 46 fs/cifs (smb3 client) changesets, 37 in fs/cifs and 9 for related helper functions and cleanup outside from Dave Howells and Willy 2023-02-22 17:12:44 -08:00
blk-merge.c block-6.3-2023-03-03 2023-03-03 10:21:39 -08:00
blk-mq-cpumap.c blk-mq: Build default queue map via group_cpus_evenly() 2023-01-17 18:50:06 +01:00
blk-mq-debugfs-zoned.c block: move zone related fields to struct gendisk 2022-07-06 06:46:26 -06:00
blk-mq-debugfs.c blk-rq-qos: store a gendisk instead of request_queue in struct rq_qos 2023-02-03 08:20:05 -07:00
blk-mq-debugfs.h block: remove per-disk debugfs files in blk_unregister_queue 2022-06-17 07:31:05 -06:00
blk-mq-pci.c block: Change the return type of blk_mq_map_queues() into void 2022-08-22 10:07:53 -06:00
blk-mq-rdma.c block: Change the return type of blk_mq_map_queues() into void 2022-08-22 10:07:53 -06:00
blk-mq-sched.c blk-mq: correct stale comment of .get_budget 2023-02-06 09:22:29 -07:00
blk-mq-sched.h block: move blk_mq_sched_assign_ioc to blk-ioc.c 2021-11-29 06:41:29 -07:00
blk-mq-sysfs.c block: make kobj_type structures constant 2023-02-09 09:38:16 -07:00
blk-mq-tag.c sbitmap: fix batched wait_cnt accounting 2022-09-12 00:10:34 -06:00
blk-mq-tag.h blk-mq: blk_mq_tag_busy is no need to return a value 2022-06-27 06:29:12 -06:00
blk-mq-virtio.c block: Change the return type of blk_mq_map_queues() into void 2022-08-22 10:07:53 -06:00
blk-mq.c block-6.3-2023-03-03 2023-03-03 10:21:39 -08:00
blk-mq.h blk-mq: move the srcu_struct used for quiescing to the tagset 2022-11-02 08:35:34 -06:00
blk-pm.c scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume() 2021-12-22 23:38:29 -05:00
blk-pm.h block: Remove unused blk_pm_*() function definitions 2021-02-22 06:33:48 -07:00
blk-rq-qos.c blk-rq-qos: store a gendisk instead of request_queue in struct rq_qos 2023-02-03 08:20:05 -07:00
blk-rq-qos.h blk-rq-qos: store a gendisk instead of request_queue in struct rq_qos 2023-02-03 08:20:05 -07:00
blk-settings.c blk-wbt: move private information from blk-wbt.h to blk-wbt.c 2023-02-03 08:20:05 -07:00
blk-stat.c block: don't call blk_throtl_stat_add for non-READ/WRITE commands 2023-02-03 08:20:04 -07:00
blk-stat.h block: make queue stat accounting a reference 2021-12-14 17:23:05 -07:00
blk-sysfs.c block: make kobj_type structures constant 2023-02-09 09:38:16 -07:00
blk-throttle.c Revert "blk-cgroup: pin the gendisk in struct blkcg_gq" 2023-02-14 14:24:09 -07:00
blk-throttle.h blk-throttle: pass a gendisk to blk_throtl_cancel_bios 2022-09-26 19:17:28 -06:00
blk-timeout.c
blk-wbt.c blk-rq-qos: store a gendisk instead of request_queue in struct rq_qos 2023-02-03 08:20:05 -07:00
blk-wbt.h blk-wbt: move private information from blk-wbt.h to blk-wbt.c 2023-02-03 08:20:05 -07:00
blk-zoned.c block: remove more NULL checks after bdev_get_queue() 2023-02-21 09:23:22 -07:00
blk.h blk-mq: enforce op-specific segment limits in blk_insert_cloned_request 2023-03-02 21:00:20 -07:00
bounce.c block: change the blk_queue_bounce calling convention 2022-08-02 17:22:54 -06:00
bsg-lib.c blk-mq: move the call to blk_put_queue out of blk_mq_destroy_queue 2022-10-25 08:25:10 -06:00
bsg.c Driver Core changes for 6.2-rc1 2022-12-16 03:54:54 -08:00
disk-events.c block: remove genhd.h 2022-02-02 07:49:59 -07:00
elevator.c block: make kobj_type structures constant 2023-02-09 09:38:16 -07:00
elevator.h block: add proper helpers for elevator_type module refcount management 2022-10-23 18:59:17 -06:00
fops.c block: don't allow multiple bios for IOCB_NOWAIT issue 2023-01-29 15:18:34 -07:00
genhd.c block: fix wrong mode for blkdev_put() from disk_scan_partitions() 2023-03-07 07:24:38 -07:00
holder.c block: don't allow a disk link holder to itself 2022-11-16 15:19:56 -07:00
ioctl.c block: fix scan partition for exclusively open device again 2023-02-17 06:15:57 -07:00
ioprio.c block: Fix handling of tasks without ioprio in ioprio_get(2) 2022-06-27 06:29:12 -06:00
Kconfig block: Remove "select SRCU" 2023-01-05 08:50:10 -07:00
Kconfig.iosched block: Default to use cgroup support for BFQ 2023-01-30 09:42:42 -07:00
kyber-iosched.c treewide: Convert del_timer*() to timer_shutdown*() 2022-12-25 13:38:09 -08:00
Makefile blk-cgroup: move blkcg_{get,set}_fc_appid out of line 2022-05-02 14:06:20 -06:00
mq-deadline.c block: mq-deadline: Rename deadline_is_seq_writes() 2022-11-28 19:27:45 -07:00
opal_proto.h block: sed-opal: Add ioctl to return device status 2022-08-22 07:52:51 -06:00
sed-opal.c sed-opal: add support flag for SUM in status ioctl 2023-02-17 06:15:53 -07:00
t10-pi.c block: add pi for extended integrity 2022-03-07 12:48:35 -07:00