Yu Kuai e2f2a39452 block, bfq: fix uaf for 'stable_merge_bfqq' ... Before commit fd571df0ac ("block, bfq: turn bfqq_data into an array in bfq_io_cq"), process reference is read before bfq_put_stable_ref(), and it's safe if bfq_put_stable_ref() put the last reference, because process reference will be 0 and 'stable_merge_bfqq' won't be accessed in this case. However, the commit changed the order and will cause uaf for 'stable_merge_bfqq'. In order to emphasize that bfq_put_stable_ref() can drop the last reference, fix the problem by moving bfq_put_stable_ref() to the end of bfq_setup_stable_merge(). Fixes: fd571df0ac ("block, bfq: turn bfqq_data into an array in bfq_io_cq") Reported-and-tested-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com> Link: https://lore.kernel.org/linux-block/20230307071448.rzihxbm4jhbf5krj@shindev/ Signed-off-by: Yu Kuai <yukuai3@huawei.com> Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Jens Axboe <axboe@kernel.dk>		2023-03-08 07:34:50 -07:00
..
partitions	driver core: make struct device_type.uevent() take a const *	2023-01-27 13:45:36 +01:00
Kconfig	block: Remove "select SRCU"	2023-01-05 08:50:10 -07:00
Kconfig.iosched	block: Default to use cgroup support for BFQ	2023-01-30 09:42:42 -07:00
Makefile	blk-cgroup: move blkcg_{get,set}_fc_appid out of line	2022-05-02 14:06:20 -06:00
badblocks.c	block/badblocks: Remove redundant assignments	2022-04-23 07:15:26 -06:00
bdev.c	block: remove ->rw_page	2023-02-02 22:33:34 -08:00
bfq-cgroup.c	for-6.3/block-2023-02-16	2023-02-20 14:27:21 -08:00
bfq-iosched.c	block, bfq: fix uaf for 'stable_merge_bfqq'	2023-03-08 07:34:50 -07:00
bfq-iosched.h	block, bfq: cleanup 'bfqg->online'	2023-02-07 10:20:59 -07:00
bfq-wf2q.c	block, bfq: inject I/O to underutilized actuators	2023-01-29 15:18:33 -07:00
bio-integrity.c	block: bio-integrity: Copy flags when bio_integrity_payload is cloned	2023-02-16 11:05:41 -07:00
bio.c	block-6.3-2023-03-03	2023-03-03 10:21:39 -08:00
blk-cgroup-fc-appid.c	cgroup: Homogenize cgroup_get_from_id() return value	2022-08-26 10:57:41 -10:00
blk-cgroup-rwstat.c	Revert "blk-cgroup: pin the gendisk in struct blkcg_gq"	2023-02-14 14:24:09 -07:00
blk-cgroup-rwstat.h	block: Use the new blk_opf_t type	2022-07-14 12:14:30 -06:00
blk-cgroup.c	for-6.3/block-2023-02-16	2023-02-20 14:27:21 -08:00
blk-cgroup.h	Revert "blk-cgroup: pin the gendisk in struct blkcg_gq"	2023-02-14 14:24:09 -07:00
blk-core.c	block-6.3-2023-03-03	2023-03-03 10:21:39 -08:00
blk-crypto-fallback.c	treewide: use get_random_bytes() when possible	2022-10-11 17:42:58 -06:00
blk-crypto-internal.h	blk-crypto: pass a gendisk to blk_crypto_sysfs_{,un}register	2022-11-30 11:09:00 -07:00
blk-crypto-profile.c	blk-crypto: Add a missing include directive	2022-11-23 10:38:54 -07:00
blk-crypto-sysfs.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
blk-crypto.c	for-6.2/block-2022-12-08	2022-12-13 10:43:59 -08:00
blk-flush.c	block: change request end_io handler to pass back a return value	2022-09-30 07:49:09 -06:00
blk-ia-ranges.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
blk-integrity.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
blk-ioc.c	block: fix default IO priority handling again	2022-06-27 06:29:12 -06:00
blk-iocost.c	blk-iocost: Pass gendisk to ioc_refresh_params	2023-02-28 05:51:19 -07:00
blk-iolatency.c	Revert "blk-cgroup: pin the gendisk in struct blkcg_gq"	2023-02-14 14:24:09 -07:00
blk-ioprio.c	blk-cgroup: pass a gendisk to pd_alloc_fn	2023-02-03 08:20:05 -07:00
blk-ioprio.h	blk-ioprio: pass a gendisk to blk_ioprio_init and blk_ioprio_exit	2022-09-26 19:09:31 -06:00
blk-lib.c	blk-lib: fix blkdev_issue_secure_erase	2022-09-15 00:25:17 -06:00
blk-map.c	46 fs/cifs (smb3 client) changesets, 37 in fs/cifs and 9 for related helper functions and cleanup outside from Dave Howells and Willy	2023-02-22 17:12:44 -08:00
blk-merge.c	block-6.3-2023-03-03	2023-03-03 10:21:39 -08:00
blk-mq-cpumap.c	blk-mq: Build default queue map via group_cpus_evenly()	2023-01-17 18:50:06 +01:00
blk-mq-debugfs-zoned.c	block: move zone related fields to struct gendisk	2022-07-06 06:46:26 -06:00
blk-mq-debugfs.c	blk-rq-qos: store a gendisk instead of request_queue in struct rq_qos	2023-02-03 08:20:05 -07:00
blk-mq-debugfs.h	block: remove per-disk debugfs files in blk_unregister_queue	2022-06-17 07:31:05 -06:00
blk-mq-pci.c	block: Change the return type of blk_mq_map_queues() into void	2022-08-22 10:07:53 -06:00
blk-mq-rdma.c	block: Change the return type of blk_mq_map_queues() into void	2022-08-22 10:07:53 -06:00
blk-mq-sched.c	blk-mq: correct stale comment of .get_budget	2023-02-06 09:22:29 -07:00
blk-mq-sched.h	block: move blk_mq_sched_assign_ioc to blk-ioc.c	2021-11-29 06:41:29 -07:00
blk-mq-sysfs.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
blk-mq-tag.c	sbitmap: fix batched wait_cnt accounting	2022-09-12 00:10:34 -06:00
blk-mq-tag.h	blk-mq: blk_mq_tag_busy is no need to return a value	2022-06-27 06:29:12 -06:00
blk-mq-virtio.c	block: Change the return type of blk_mq_map_queues() into void	2022-08-22 10:07:53 -06:00
blk-mq.c	block-6.3-2023-03-03	2023-03-03 10:21:39 -08:00
blk-mq.h	blk-mq: move the srcu_struct used for quiescing to the tagset	2022-11-02 08:35:34 -06:00
blk-pm.c	scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume()	2021-12-22 23:38:29 -05:00
blk-pm.h	block: Remove unused blk_pm_*() function definitions	2021-02-22 06:33:48 -07:00
blk-rq-qos.c	blk-rq-qos: store a gendisk instead of request_queue in struct rq_qos	2023-02-03 08:20:05 -07:00
blk-rq-qos.h	blk-rq-qos: store a gendisk instead of request_queue in struct rq_qos	2023-02-03 08:20:05 -07:00
blk-settings.c	blk-wbt: move private information from blk-wbt.h to blk-wbt.c	2023-02-03 08:20:05 -07:00
blk-stat.c	block: don't call blk_throtl_stat_add for non-READ/WRITE commands	2023-02-03 08:20:04 -07:00
blk-stat.h	block: make queue stat accounting a reference	2021-12-14 17:23:05 -07:00
blk-sysfs.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
blk-throttle.c	Revert "blk-cgroup: pin the gendisk in struct blkcg_gq"	2023-02-14 14:24:09 -07:00
blk-throttle.h	blk-throttle: pass a gendisk to blk_throtl_cancel_bios	2022-09-26 19:17:28 -06:00
blk-timeout.c	block: blk-timeout: delete duplicated word	2020-07-31 16:29:47 -06:00
blk-wbt.c	blk-rq-qos: store a gendisk instead of request_queue in struct rq_qos	2023-02-03 08:20:05 -07:00
blk-wbt.h	blk-wbt: move private information from blk-wbt.h to blk-wbt.c	2023-02-03 08:20:05 -07:00
blk-zoned.c	block: remove more NULL checks after bdev_get_queue()	2023-02-21 09:23:22 -07:00
blk.h	blk-mq: enforce op-specific segment limits in blk_insert_cloned_request	2023-03-02 21:00:20 -07:00
bounce.c	block: change the blk_queue_bounce calling convention	2022-08-02 17:22:54 -06:00
bsg-lib.c	blk-mq: move the call to blk_put_queue out of blk_mq_destroy_queue	2022-10-25 08:25:10 -06:00
bsg.c	Driver Core changes for 6.2-rc1	2022-12-16 03:54:54 -08:00
disk-events.c	block: remove genhd.h	2022-02-02 07:49:59 -07:00
elevator.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
elevator.h	block: add proper helpers for elevator_type module refcount management	2022-10-23 18:59:17 -06:00
fops.c	block: don't allow multiple bios for IOCB_NOWAIT issue	2023-01-29 15:18:34 -07:00
genhd.c	block: fix wrong mode for blkdev_put() from disk_scan_partitions()	2023-03-07 07:24:38 -07:00
holder.c	block: don't allow a disk link holder to itself	2022-11-16 15:19:56 -07:00
ioctl.c	block: fix scan partition for exclusively open device again	2023-02-17 06:15:57 -07:00
ioprio.c	block: Fix handling of tasks without ioprio in ioprio_get(2)	2022-06-27 06:29:12 -06:00
kyber-iosched.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
mq-deadline.c	block: mq-deadline: Rename deadline_is_seq_writes()	2022-11-28 19:27:45 -07:00
opal_proto.h	block: sed-opal: Add ioctl to return device status	2022-08-22 07:52:51 -06:00
sed-opal.c	sed-opal: add support flag for SUM in status ioctl	2023-02-17 06:15:53 -07:00
t10-pi.c	block: add pi for extended integrity	2022-03-07 12:48:35 -07:00