Messages in this thread | | | Subject | Re: [PATCH] block, bfq: fix uaf for bfqq in bic_set_bfqq() | From | Holger Hoffstätte <> | Date | Tue, 21 Feb 2023 11:19:21 +0100 |
| |
On 2023-02-21 08:04, Yu Kuai wrote: > Hi, Jens > > 在 2023/01/13 17:44, Yu Kuai 写道: >> After commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'"), >> bic->bfqq will be accessed in bic_set_bfqq(), however, in some context >> bic->bfqq will be freed first, and bic_set_bfqq() is called with the freed >> bic->bfqq. >> >> Fix the problem by always freeing bfqq after bic_set_bfqq(). >> >> Fixes: 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") >> Reported-and-tested-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com> >> Signed-off-by: Yu Kuai <yukuai3@huawei.com> >> --- >> block/bfq-cgroup.c | 2 +- >> block/bfq-iosched.c | 4 +++- >> 2 files changed, 4 insertions(+), 2 deletions(-) >> >> diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c >> index a6e8da5f5cfd..feb13ac25557 100644 >> --- a/block/bfq-cgroup.c >> +++ b/block/bfq-cgroup.c >> @@ -749,8 +749,8 @@ static void bfq_sync_bfqq_move(struct bfq_data *bfqd, >> * old cgroup. >> */ >> bfq_put_cooperator(sync_bfqq); >> - bfq_release_process_ref(bfqd, sync_bfqq); >> bic_set_bfqq(bic, NULL, true, act_idx); >> + bfq_release_process_ref(bfqd, sync_bfqq); >> } >> } >> > > It seems this change is missed in GIT PULL for-6.3. I'll send a seperate > patch to fix this... >
It was already applied in time for 6.2 as b600de2d7d3a16f9007fad1bdae82a3951a26af2 and also already merged to 6.1-stable.
cheers Holger
| |