mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-07-08 18:13:59 +02:00
Acs, Jakub
7400fa1729
Commiteca0025faa("block, bfq: split sync bfq_queues on a per-actuator basis"), which is a backport of9778369a2d("block, bfq: split sync bfq_queues on a per-actuator basis") re-introduces UAF bug originally fixed byb600de2d7d("block, bfq: fix uaf for bfqq in bic_set_bfqq()") and backported to 6.1 incb1876fc33("block, bfq: fix uaf for bfqq in bic_set_bfqq()"). bfq_release_process_ref() may release the sync_bfqq variable, which points to the same bfqq as bic->bfqq member for call context from __bfq_bic_change_cgroup(). bic_set_bfqq() then accesses bic->bfqq member which leads to the UAF condition. Fix this by bringing the incriminated function calls back in correct order. Fixes:eca0025faa("block, bfq: split sync bfq_queues on a per-actuator basis") Signed-off-by: Jakub Acs <acsjakub@amazon.de> Cc: Hagar Hemdan <hagarhem@amazon.com> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>