Shigeru Yoshida 8d12ec1029 virtio-blk: Avoid use-after-free on suspend/resume ... hctx->user_data is set to vq in virtblk_init_hctx(). However, vq is freed on suspend and reallocated on resume. So, hctx->user_data is invalid after resume, and it will cause use-after-free accessing which will result in the kernel crash something like below: [ 22.428391] Call Trace: [ 22.428899] <TASK> [ 22.429339] virtqueue_add_split+0x3eb/0x620 [ 22.430035] ? __blk_mq_alloc_requests+0x17f/0x2d0 [ 22.430789] ? kvm_clock_get_cycles+0x14/0x30 [ 22.431496] virtqueue_add_sgs+0xad/0xd0 [ 22.432108] virtblk_add_req+0xe8/0x150 [ 22.432692] virtio_queue_rqs+0xeb/0x210 [ 22.433330] blk_mq_flush_plug_list+0x1b8/0x280 [ 22.434059] __blk_flush_plug+0xe1/0x140 [ 22.434853] blk_finish_plug+0x20/0x40 [ 22.435512] read_pages+0x20a/0x2e0 [ 22.436063] ? folio_add_lru+0x62/0xa0 [ 22.436652] page_cache_ra_unbounded+0x112/0x160 [ 22.437365] filemap_get_pages+0xe1/0x5b0 [ 22.437964] ? context_to_sid+0x70/0x100 [ 22.438580] ? sidtab_context_to_sid+0x32/0x400 [ 22.439979] filemap_read+0xcd/0x3d0 [ 22.440917] xfs_file_buffered_read+0x4a/0xc0 [ 22.441984] xfs_file_read_iter+0x65/0xd0 [ 22.442970] __kernel_read+0x160/0x2e0 [ 22.443921] bprm_execve+0x21b/0x640 [ 22.444809] do_execveat_common.isra.0+0x1a8/0x220 [ 22.446008] __x64_sys_execve+0x2d/0x40 [ 22.446920] do_syscall_64+0x37/0x90 [ 22.447773] entry_SYSCALL_64_after_hwframe+0x63/0xcd This patch fixes this issue by getting vq from vblk, and removes virtblk_init_hctx(). Fixes: 4e04005256 ("virtio-blk: support polling I/O") Cc: "Suwan Kim" <suwan.kim027@gmail.com> Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> Message-Id: <20220810160948.959781-1-syoshida@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>		2022-08-11 04:30:59 -04:00
..
aoe	aoe: Avoid flush_scheduled_work() usage	2022-05-01 06:41:41 -06:00
drbd	drbd: Return true/false (not 1/0) from bool functions	2022-04-17 19:54:24 -06:00
mtip32xx	mtip32xx: fix typo in comment	2022-05-21 06:32:27 -06:00
null_blk	block: null_blk: Fix null_zone_write()	2022-06-02 07:11:28 -06:00
paride	Char/Misc and other driver changes for 5.17-rc1	2022-01-14 16:02:28 +01:00
rnbd	rnbd-srv: use bdev_discard_alignment	2022-05-03 10:38:50 -06:00
xen-blkback	xen-blkback: use bdev_discard_alignment	2022-05-04 05:24:40 -06:00
zram	Yang Shi has improved the behaviour of khugepaged collapsing of readonly	2022-05-26 12:32:41 -07:00
Kconfig	floppy: disable FDRAWCMD by default	2022-04-27 09:41:54 -07:00
Makefile	block: remove the rsxx driver	2021-12-16 10:57:04 -07:00
amiflop.c	block: remove the ->rq_disk field in struct request	2021-11-29 06:41:29 -07:00
ataflop.c	ataflop: use a statically allocated error counters	2022-05-08 10:01:48 -07:00
brd.c	brd: remove brd_devices_mutex mutex	2022-01-17 07:19:40 -07:00
floppy.c	floppy: use a statically allocated error counter	2022-05-08 10:01:48 -07:00
loop.c	for-5.19/drivers-2022-06-02	2022-06-03 10:25:56 -07:00
n64cart.c	n64cart: convert bi_disk to bi_bdev->bd_disk fix build	2022-03-21 06:34:45 -06:00
nbd.c	nbd: use pr_err to output error message	2022-05-27 20:39:33 -06:00
pktcdvd.c	for-5.19/block-2022-05-22	2022-05-23 13:56:39 -07:00
ps3disk.c	ps3disk: add error handling support for add_disk()	2021-10-30 11:03:37 -06:00
ps3vram.c	block: remove GENHD_FL_EXT_DEVT	2021-11-29 06:38:35 -07:00
rbd.c	A big pile of assorted fixes and improvements for the filesystem with	2022-06-02 08:59:39 -07:00
rbd_types.h	…
sunvdc.c	block: remove genhd.h	2022-02-02 07:49:59 -07:00
swim.c	block: remove GENHD_FL_EXT_DEVT	2021-11-29 06:38:35 -07:00
swim3.c	block: remove GENHD_FL_EXT_DEVT	2021-11-29 06:38:35 -07:00
swim_asm.S	…
sx8.c	blk-mq: remove the done argument to blk_execute_rq_nowait	2022-05-28 06:15:27 -06:00
virtio_blk.c	virtio-blk: Avoid use-after-free on suspend/resume	2022-08-11 04:30:59 -04:00
xen-blkfront.c	xen/blkfront: force data bouncing when backend is untrusted	2022-07-01 10:00:50 +02:00
z2ram.c	block: remove GENHD_FL_EXT_DEVT	2021-11-29 06:38:35 -07:00