Messages in this thread | | | Subject | Re: [PATCH] block, bfq: fix uaf for bfqq in bic_set_bfqq() | From | Yu Kuai <> | Date | Tue, 21 Feb 2023 15:04:08 +0800 |
| |
Hi, Jens
在 2023/01/13 17:44, Yu Kuai 写道: > After commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'"), > bic->bfqq will be accessed in bic_set_bfqq(), however, in some context > bic->bfqq will be freed first, and bic_set_bfqq() is called with the freed > bic->bfqq. > > Fix the problem by always freeing bfqq after bic_set_bfqq(). > > Fixes: 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") > Reported-and-tested-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com> > Signed-off-by: Yu Kuai <yukuai3@huawei.com> > --- > block/bfq-cgroup.c | 2 +- > block/bfq-iosched.c | 4 +++- > 2 files changed, 4 insertions(+), 2 deletions(-) > > diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c > index a6e8da5f5cfd..feb13ac25557 100644 > --- a/block/bfq-cgroup.c > +++ b/block/bfq-cgroup.c > @@ -749,8 +749,8 @@ static void bfq_sync_bfqq_move(struct bfq_data *bfqd, > * old cgroup. > */ > bfq_put_cooperator(sync_bfqq); > - bfq_release_process_ref(bfqd, sync_bfqq); > bic_set_bfqq(bic, NULL, true, act_idx); > + bfq_release_process_ref(bfqd, sync_bfqq); > } > } >
It seems this change is missed in GIT PULL for-6.3. I'll send a seperate patch to fix this...
Thanks, Kuai
| |