TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
v5.10.201
twx-linux/block
T
History
Ming Lei f94471c0cc block: fix use-after-free of q->q_usage_counter 
commit d36a9ea5e7 upstream.

For blk-mq, queue release handler is usually called after
blk_mq_freeze_queue_wait() returns. However, the
q_usage_counter->release() handler may not be run yet at that time, so
this can cause a use-after-free.

Fix the issue by moving percpu_ref_exit() into blk_free_queue_rcu().
Since ->release() is called with rcu read lock held, it is agreed that
the race should be covered in caller per discussion from the two links.

Reported-by: Zhang Wensheng <zhangwensheng@huaweicloud.com>
Reported-by: Zhong Jinghua <zhongjinghua@huawei.com>
Link: https://lore.kernel.org/linux-block/Y5prfOjyyjQKUrtH@T590/T/#u
Link: https://lore.kernel.org/lkml/Y4%2FmzMd4evRg9yDi@fedora/
Cc: Hillf Danton <hdanton@sina.com>
Cc: Yu Kuai <yukuai3@huawei.com>
Cc: Dennis Zhou <dennis@kernel.org>
Fixes: 2b0d3d3e4f ("percpu_ref: reduce memory footprint of percpu_ref in fast path")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20221215021629.74870-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Saranya Muruganandam <saranyamohan@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-10-10 21:53:36 +02:00
..
partitions
block/partition: fix signedness issue for Amiga partitions
2023-07-27 08:44:18 +02:00
badblocks.c
…
bfq-cgroup.c
block, bfq: fix uaf for bfqq in bic_set_bfqq()
2023-03-17 08:45:14 +01:00
bfq-iosched.c
block, bfq: fix uaf for bfqq in bic_set_bfqq()
2023-03-17 08:45:14 +01:00
bfq-iosched.h
bfq: Get rid of __bio_blkcg() usage
2022-06-09 10:21:31 +02:00
bfq-wf2q.c
…
bio-integrity.c
block: bio-integrity: Copy flags when bio_integrity_payload is cloned
2023-03-11 16:39:16 +01:00
bio.c
block: fix infinite loop for invalid zone append
2022-08-21 15:15:34 +02:00
blk-cgroup-rwstat.c
…
blk-cgroup-rwstat.h
…
blk-cgroup.c
blk-cgroup: fix missing pd_online_fn() while activating policy
2023-02-06 07:56:15 +01:00
blk-core.c
block: fix use-after-free of q->q_usage_counter
2023-10-10 21:53:36 +02:00
blk-crypto-fallback.c
…
blk-crypto-internal.h
blk-mq: release crypto keyslot before reporting I/O complete
2023-05-17 11:47:32 +02:00
blk-crypto.c
blk-crypto: make blk_crypto_evict_key() more robust
2023-05-17 11:47:32 +02:00
blk-exec.c
…
blk-flush.c
…
blk-integrity.c
…
blk-ioc.c
…
blk-iocost.c
blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost
2023-07-27 08:43:32 +02:00
blk-iolatency.c
blk-iolatency: Fix inflight count imbalances and IO hangs on offline
2022-06-09 10:21:29 +02:00
blk-lib.c
…
blk-map.c
block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
2022-05-12 12:25:45 +02:00
blk-merge.c
blk-mq: release crypto keyslot before reporting I/O complete
2023-05-17 11:47:32 +02:00
blk-mq-cpumap.c
…
blk-mq-debugfs-zoned.c
…
blk-mq-debugfs.c
blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created
2022-08-21 15:15:35 +02:00
blk-mq-debugfs.h
…
blk-mq-pci.c
…
blk-mq-rdma.c
…
blk-mq-sched.c
blk-mq: correct stale comment of .get_budget
2023-03-11 16:39:15 +01:00
blk-mq-sched.h
…
blk-mq-sysfs.c
blk-mq: fix possible memleak when register 'hctx' failed
2023-01-14 10:16:19 +01:00
blk-mq-tag.c
…
blk-mq-tag.h
…
blk-mq-virtio.c
…
blk-mq.c
blk-mq: release crypto keyslot before reporting I/O complete
2023-05-17 11:47:32 +02:00
blk-mq.h
…
blk-pm.c
…
blk-pm.h
…
blk-rq-qos.c
…
blk-rq-qos.h
…
blk-settings.c
…
blk-stat.c
…
blk-stat.h
…
blk-sysfs.c
block: fix use-after-free of q->q_usage_counter
2023-10-10 21:53:36 +02:00
blk-throttle.c
blk-throttle: prevent overflow while calculating wait time
2022-10-26 13:25:53 +02:00
blk-timeout.c
…
blk-wbt.c
blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()
2022-10-30 09:41:19 +01:00
blk-wbt.h
…
blk-zoned.c
…
blk.h
…
bounce.c
…
bsg-lib.c
…
bsg.c
…
cmdline-parser.c
…
elevator.c
…
genhd.c
…
ioctl.c
…
ioprio.c
…
Kconfig
…
Kconfig.iosched
…
keyslot-manager.c
blk-crypto: make blk_crypto_evict_key() more robust
2023-05-17 11:47:32 +02:00
kyber-iosched.c
…
Makefile
…
mq-deadline.c
…
opal_proto.h
…
scsi_ioctl.c
…
sed-opal.c
block: sed-opal: kmalloc the cmd/resp buffers
2022-11-25 17:45:43 +01:00
t10-pi.c
…