Yu Kuai 7949b0df3d block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq ...

[ Upstream commit 246cf66e30 ]

Commit 64dc8c732f ("block, bfq: fix possible uaf for 'bfqq->bic'")
will access 'bic->bfqq' in bic_set_bfqq(), however, bfq_exit_icq_bfqq()
can free bfqq first, and then call bic_set_bfqq(), which will cause uaf.

Fix the problem by moving bfq_exit_bfqq() behind bic_set_bfqq().

Fixes: 64dc8c732f ("block, bfq: fix possible uaf for 'bfqq->bic'")
Reported-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20221226030605.1437081-1-yukuai1@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-01-12 11:58:43 +01:00

..

partitions

…

badblocks.c

…

bdev.c

block: simplify the block device syncing code

2022-04-27 14:38:50 +02:00

bfq-cgroup.c

block, bfq: fix null pointer dereference in bfq_bio_bfqg()

2022-12-02 17:41:02 +01:00

bfq-iosched.c

block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq

2023-01-12 11:58:43 +01:00

bfq-iosched.h

bfq: Get rid of __bio_blkcg() usage

2022-06-09 10:23:19 +02:00

bfq-wf2q.c

…

bio-integrity.c

…

bio.c

block: ensure iov_iter advances for added pages

2022-08-17 14:24:01 +02:00

blk-cgroup-rwstat.c

…

blk-cgroup-rwstat.h

…

blk-cgroup.c

block: fix bio_clone_blkg_association() to associate with proper blkcg_gq

2022-06-09 10:23:32 +02:00

blk-core.c

block: blk_queue_enter() / __bio_queue_enter() must return -EAGAIN for nowait

2022-09-23 14:15:48 +02:00

blk-crypto-fallback.c

…

blk-crypto-internal.h

…

blk-crypto.c

…

blk-exec.c

…

blk-flush.c

…

blk-integrity.c

…

blk-ioc.c

block: fix default IO priority handling again

2022-08-11 13:07:50 +02:00

blk-iocost.c

block: don't allow the same type rq_qos add more than once

2022-08-17 14:24:24 +02:00

blk-iolatency.c

block: don't allow the same type rq_qos add more than once

2022-08-17 14:24:24 +02:00

blk-ioprio.c

…

blk-ioprio.h

…

blk-lib.c

…

blk-map.c

…

blk-merge.c

…

blk-mq-cpumap.c

…

blk-mq-debugfs-zoned.c

…

blk-mq-debugfs.c

blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created

2022-08-17 14:23:12 +02:00

blk-mq-debugfs.h

…

blk-mq-pci.c

…

blk-mq-rdma.c

…

blk-mq-sched.c

…

blk-mq-sched.h

…

blk-mq-sysfs.c

blk-mq: fix possible memleak when register 'hctx' failed

2022-12-31 13:14:43 +01:00

blk-mq-tag.c

…

blk-mq-tag.h

…

blk-mq-virtio.c

…

blk-mq.c

blk-mq: fix io hung due to missing commit_rqs

2022-08-31 17:16:50 +02:00

blk-mq.h

…

blk-pm.c

…

blk-pm.h

…

blk-rq-qos.c

…

blk-rq-qos.h

block: don't allow the same type rq_qos add more than once

2022-08-17 14:24:24 +02:00

blk-settings.c

…

blk-stat.c

…

blk-stat.h

…

blk-sysfs.c

…

blk-throttle.c

blk-throttle: prevent overflow while calculating wait time

2022-10-26 12:35:47 +02:00

blk-timeout.c

…

blk-wbt.c

blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()

2022-10-26 12:35:54 +02:00

blk-wbt.h

…

blk-zoned.c

…

blk.h

…

bounce.c

…

bsg-lib.c

…

bsg.c

…

disk-events.c

…

elevator.c

…

fops.c

…

genhd.c

block: clear ->slave_dir when dropping the main slave_dir reference

2022-12-31 13:14:10 +01:00

holder.c

…

ioctl.c

block/compat_ioctl: fix range check in BLKGETSIZE

2022-04-27 14:39:02 +02:00

ioprio.c

block: fix default IO priority handling again

2022-08-11 13:07:50 +02:00

Kconfig

…

Kconfig.iosched

…

keyslot-manager.c

…

kyber-iosched.c

…

Makefile

block: move CONFIG_BLOCK guard to top Makefile

2022-12-14 11:37:30 +01:00

mq-deadline.c

…

opal_proto.h

…

sed-opal.c

block: sed-opal: kmalloc the cmd/resp buffers

2022-11-26 09:24:35 +01:00

t10-pi.c

…