mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-24 11:25:43 +00:00
block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq
[ Upstream commit246cf66e30
] Commit64dc8c732f
("block, bfq: fix possible uaf for 'bfqq->bic'") will access 'bic->bfqq' in bic_set_bfqq(), however, bfq_exit_icq_bfqq() can free bfqq first, and then call bic_set_bfqq(), which will cause uaf. Fix the problem by moving bfq_exit_bfqq() behind bic_set_bfqq(). Fixes:64dc8c732f
("block, bfq: fix possible uaf for 'bfqq->bic'") Reported-by: Yi Zhang <yi.zhang@redhat.com> Signed-off-by: Yu Kuai <yukuai3@huawei.com> Link: https://lore.kernel.org/r/20221226030605.1437081-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
358a77b784
commit
cfe5b38c37
1 changed files with 1 additions and 1 deletions
|
@ -5385,8 +5385,8 @@ static void bfq_exit_icq_bfqq(struct bfq_io_cq *bic, bool is_sync)
|
||||||
unsigned long flags;
|
unsigned long flags;
|
||||||
|
|
||||||
spin_lock_irqsave(&bfqd->lock, flags);
|
spin_lock_irqsave(&bfqd->lock, flags);
|
||||||
bfq_exit_bfqq(bfqd, bfqq);
|
|
||||||
bic_set_bfqq(bic, NULL, is_sync);
|
bic_set_bfqq(bic, NULL, is_sync);
|
||||||
|
bfq_exit_bfqq(bfqd, bfqq);
|
||||||
spin_unlock_irqrestore(&bfqd->lock, flags);
|
spin_unlock_irqrestore(&bfqd->lock, flags);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue