Yu Kuai e2f2a39452 block, bfq: fix uaf for 'stable_merge_bfqq' ... Before commit fd571df0ac ("block, bfq: turn bfqq_data into an array in bfq_io_cq"), process reference is read before bfq_put_stable_ref(), and it's safe if bfq_put_stable_ref() put the last reference, because process reference will be 0 and 'stable_merge_bfqq' won't be accessed in this case. However, the commit changed the order and will cause uaf for 'stable_merge_bfqq'. In order to emphasize that bfq_put_stable_ref() can drop the last reference, fix the problem by moving bfq_put_stable_ref() to the end of bfq_setup_stable_merge(). Fixes: fd571df0ac ("block, bfq: turn bfqq_data into an array in bfq_io_cq") Reported-and-tested-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com> Link: https://lore.kernel.org/linux-block/20230307071448.rzihxbm4jhbf5krj@shindev/ Signed-off-by: Yu Kuai <yukuai3@huawei.com> Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Jens Axboe <axboe@kernel.dk>		2023-03-08 07:34:50 -07:00
..
partitions	driver core: make struct device_type.uevent() take a const *	2023-01-27 13:45:36 +01:00
Kconfig	block: Remove "select SRCU"	2023-01-05 08:50:10 -07:00
Kconfig.iosched	block: Default to use cgroup support for BFQ	2023-01-30 09:42:42 -07:00
Makefile	…
badblocks.c	…
bdev.c	block: remove ->rw_page	2023-02-02 22:33:34 -08:00
bfq-cgroup.c	for-6.3/block-2023-02-16	2023-02-20 14:27:21 -08:00
bfq-iosched.c	block, bfq: fix uaf for 'stable_merge_bfqq'	2023-03-08 07:34:50 -07:00
bfq-iosched.h	block, bfq: cleanup 'bfqg->online'	2023-02-07 10:20:59 -07:00
bfq-wf2q.c	block, bfq: inject I/O to underutilized actuators	2023-01-29 15:18:33 -07:00
bio-integrity.c	block: bio-integrity: Copy flags when bio_integrity_payload is cloned	2023-02-16 11:05:41 -07:00
bio.c	block-6.3-2023-03-03	2023-03-03 10:21:39 -08:00
blk-cgroup-fc-appid.c	…
blk-cgroup-rwstat.c	Revert "blk-cgroup: pin the gendisk in struct blkcg_gq"	2023-02-14 14:24:09 -07:00
blk-cgroup-rwstat.h	…
blk-cgroup.c	for-6.3/block-2023-02-16	2023-02-20 14:27:21 -08:00
blk-cgroup.h	Revert "blk-cgroup: pin the gendisk in struct blkcg_gq"	2023-02-14 14:24:09 -07:00
blk-core.c	block-6.3-2023-03-03	2023-03-03 10:21:39 -08:00
blk-crypto-fallback.c	treewide: use get_random_bytes() when possible	2022-10-11 17:42:58 -06:00
blk-crypto-internal.h	blk-crypto: pass a gendisk to blk_crypto_sysfs_{,un}register	2022-11-30 11:09:00 -07:00
blk-crypto-profile.c	blk-crypto: Add a missing include directive	2022-11-23 10:38:54 -07:00
blk-crypto-sysfs.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
blk-crypto.c	for-6.2/block-2022-12-08	2022-12-13 10:43:59 -08:00
blk-flush.c	…
blk-ia-ranges.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
blk-integrity.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
blk-ioc.c	…
blk-iocost.c	blk-iocost: Pass gendisk to ioc_refresh_params	2023-02-28 05:51:19 -07:00
blk-iolatency.c	Revert "blk-cgroup: pin the gendisk in struct blkcg_gq"	2023-02-14 14:24:09 -07:00
blk-ioprio.c	blk-cgroup: pass a gendisk to pd_alloc_fn	2023-02-03 08:20:05 -07:00
blk-ioprio.h	…
blk-lib.c	…
blk-map.c	46 fs/cifs (smb3 client) changesets, 37 in fs/cifs and 9 for related helper functions and cleanup outside from Dave Howells and Willy	2023-02-22 17:12:44 -08:00
blk-merge.c	block-6.3-2023-03-03	2023-03-03 10:21:39 -08:00
blk-mq-cpumap.c	blk-mq: Build default queue map via group_cpus_evenly()	2023-01-17 18:50:06 +01:00
blk-mq-debugfs-zoned.c	…
blk-mq-debugfs.c	blk-rq-qos: store a gendisk instead of request_queue in struct rq_qos	2023-02-03 08:20:05 -07:00
blk-mq-debugfs.h	…
blk-mq-pci.c	…
blk-mq-rdma.c	…
blk-mq-sched.c	blk-mq: correct stale comment of .get_budget	2023-02-06 09:22:29 -07:00
blk-mq-sched.h	…
blk-mq-sysfs.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
blk-mq-tag.c	…
blk-mq-tag.h	…
blk-mq-virtio.c	…
blk-mq.c	block-6.3-2023-03-03	2023-03-03 10:21:39 -08:00
blk-mq.h	blk-mq: move the srcu_struct used for quiescing to the tagset	2022-11-02 08:35:34 -06:00
blk-pm.c	…
blk-pm.h	…
blk-rq-qos.c	blk-rq-qos: store a gendisk instead of request_queue in struct rq_qos	2023-02-03 08:20:05 -07:00
blk-rq-qos.h	blk-rq-qos: store a gendisk instead of request_queue in struct rq_qos	2023-02-03 08:20:05 -07:00
blk-settings.c	blk-wbt: move private information from blk-wbt.h to blk-wbt.c	2023-02-03 08:20:05 -07:00
blk-stat.c	block: don't call blk_throtl_stat_add for non-READ/WRITE commands	2023-02-03 08:20:04 -07:00
blk-stat.h	…
blk-sysfs.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
blk-throttle.c	Revert "blk-cgroup: pin the gendisk in struct blkcg_gq"	2023-02-14 14:24:09 -07:00
blk-throttle.h	…
blk-timeout.c	…
blk-wbt.c	blk-rq-qos: store a gendisk instead of request_queue in struct rq_qos	2023-02-03 08:20:05 -07:00
blk-wbt.h	blk-wbt: move private information from blk-wbt.h to blk-wbt.c	2023-02-03 08:20:05 -07:00
blk-zoned.c	block: remove more NULL checks after bdev_get_queue()	2023-02-21 09:23:22 -07:00
blk.h	blk-mq: enforce op-specific segment limits in blk_insert_cloned_request	2023-03-02 21:00:20 -07:00
bounce.c	…
bsg-lib.c	blk-mq: move the call to blk_put_queue out of blk_mq_destroy_queue	2022-10-25 08:25:10 -06:00
bsg.c	Driver Core changes for 6.2-rc1	2022-12-16 03:54:54 -08:00
disk-events.c	…
elevator.c	block: make kobj_type structures constant	2023-02-09 09:38:16 -07:00
elevator.h	block: add proper helpers for elevator_type module refcount management	2022-10-23 18:59:17 -06:00
fops.c	block: don't allow multiple bios for IOCB_NOWAIT issue	2023-01-29 15:18:34 -07:00
genhd.c	block: fix wrong mode for blkdev_put() from disk_scan_partitions()	2023-03-07 07:24:38 -07:00
holder.c	block: don't allow a disk link holder to itself	2022-11-16 15:19:56 -07:00
ioctl.c	block: fix scan partition for exclusively open device again	2023-02-17 06:15:57 -07:00
ioprio.c	…
kyber-iosched.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
mq-deadline.c	block: mq-deadline: Rename deadline_is_seq_writes()	2022-11-28 19:27:45 -07:00
opal_proto.h	…
sed-opal.c	sed-opal: add support flag for SUM in status ioctl	2023-02-17 06:15:53 -07:00
t10-pi.c	…