From: Jens Axboe <axboe@kernel.dk>
To: jack@suse.cz, shinichiro.kawasaki@wdc.com,
paolo.valente@linaro.org, glusvardi@posteo.net,
damien.lemoal@opensource.wdc.com, felicigb@gmail.com,
inbox@emilianomaccaferri.com, Yu Kuai <yukuai1@huaweicloud.com>
Cc: linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
yukuai3@huawei.com, yi.zhang@huawei.com, yangerkun@huawei.com
Subject: Re: [PATCH] block, bfq: fix uaf for 'stable_merge_bfqq'
Date: Wed, 08 Mar 2023 07:35:37 -0700 [thread overview]
Message-ID: <167828613700.180504.7849236814026719917.b4-ty@kernel.dk> (raw)
In-Reply-To: <20230308023208.379465-1-yukuai1@huaweicloud.com>
On Wed, 08 Mar 2023 10:32:08 +0800, Yu Kuai wrote:
> Before commit fd571df0ac5b ("block, bfq: turn bfqq_data into an array
> in bfq_io_cq"), process reference is read before bfq_put_stable_ref(),
> and it's safe if bfq_put_stable_ref() put the last reference, because
> process reference will be 0 and 'stable_merge_bfqq' won't be accessed
> in this case. However, the commit changed the order and will cause
> uaf for 'stable_merge_bfqq'.
>
> [...]
Applied, thanks!
[1/1] block, bfq: fix uaf for 'stable_merge_bfqq'
commit: e2f2a39452c43b64ea3191642a2661cb8d03827a
Best regards,
--
Jens Axboe
prev parent reply other threads:[~2023-03-08 14:35 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-07 7:14 [bug report] BUG: KASAN: slab-use-after-free in bfq_setup_cooperator Shinichiro Kawasaki
2023-03-07 8:57 ` Yu Kuai
2023-03-07 9:13 ` Shinichiro Kawasaki
2023-03-07 9:36 ` Yu Kuai
2023-03-07 10:20 ` Jan Kara
2023-03-07 10:28 ` Yu Kuai
2023-03-07 11:49 ` Shinichiro Kawasaki
2023-03-07 14:26 ` Jens Axboe
2023-03-08 2:32 ` [PATCH] block, bfq: fix uaf for 'stable_merge_bfqq' Yu Kuai
2023-03-08 5:56 ` Shinichiro Kawasaki
2023-03-08 10:21 ` Jan Kara
2023-03-08 14:35 ` Jens Axboe [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=167828613700.180504.7849236814026719917.b4-ty@kernel.dk \
--to=axboe@kernel.dk \
--cc=damien.lemoal@opensource.wdc.com \
--cc=felicigb@gmail.com \
--cc=glusvardi@posteo.net \
--cc=inbox@emilianomaccaferri.com \
--cc=jack@suse.cz \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=paolo.valente@linaro.org \
--cc=shinichiro.kawasaki@wdc.com \
--cc=yangerkun@huawei.com \
--cc=yi.zhang@huawei.com \
--cc=yukuai1@huaweicloud.com \
--cc=yukuai3@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.