5.10-stable patches

added patches:
	block-unhash-blkdev-part-inode-when-the-part-is-deleted.patch

diff --git a/queue-5.10/block-unhash-blkdev-part-inode-when-the-part-is-deleted.patch b/queue-5.10/block-unhash-blkdev-part-inode-when-the-part-is-deleted.patch
new file mode 100644 (file)
index 0000000..f6aaab6
--- /dev/null
+++ b/queue-5.10/block-unhash-blkdev-part-inode-when-the-part-is-deleted.patch
@@ -0,0 +1,65 @@
+From ming.lei@redhat.com  Mon Dec  5 17:35:21 2022
+From: Ming Lei <ming.lei@redhat.com>
+Date: Mon,  5 Dec 2022 21:27:39 +0800
+Subject: [PATCH 5.10.y stable v2] block: unhash blkdev part inode when the part is deleted
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org
+Cc: Jens Axboe <axboe@kernel.dk>, linux-block@vger.kernel.org, Ming Lei <ming.lei@redhat.com>, Shiwei Cui <cuishw@inspur.com>, Christoph Hellwig <hch@lst.de>, Jan Kara <jack@suse.cz>
+Message-ID: <20221205132739.844399-1-ming.lei@redhat.com>
+
+
+v5.11 changes the blkdev lookup mechanism completely since commit
+22ae8ce8b892 ("block: simplify bdev/disk lookup in blkdev_get"),
+and small part of the change is to unhash part bdev inode when
+deleting partition. Turns out this kind of change does fix one
+nasty issue in case of BLOCK_EXT_MAJOR:
+
+1) when one partition is deleted & closed, disk_put_part() is always
+called before bdput(bdev), see blkdev_put(); so the part's devt can
+be freed & re-used before the inode is dropped
+
+2) then new partition with same devt can be created just before the
+inode in 1) is dropped, then the old inode/bdev structurein 1) is
+re-used for this new partition, this way causes use-after-free and
+kernel panic.
+
+It isn't possible to backport the whole big patchset of "merge struct
+block_device and struct hd_struct v4" for addressing this issue.
+
+https://lore.kernel.org/linux-block/20201128161510.347752-1-hch@lst.de/
+
+So fixes it by unhashing part bdev in delete_partition(), and this way
+is actually aligned with v5.11+'s behavior.
+
+Reported-by: Shiwei Cui <cuishw@inspur.com>
+Tested-by: Shiwei Cui <cuishw@inspur.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Jan Kara <jack@suse.cz>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Acked-by: Jens Axboe <axboe@kernel.dk>
+---
+ block/partitions/core.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/block/partitions/core.c
++++ b/block/partitions/core.c
+@@ -329,6 +329,7 @@ void delete_partition(struct hd_struct *
+       struct gendisk *disk = part_to_disk(part);
+       struct disk_part_tbl *ptbl =
+               rcu_dereference_protected(disk->part_tbl, 1);
++      struct block_device *bdev;
+ 
+       /*
+        * ->part_tbl is referenced in this part's release handler, so
+@@ -346,6 +347,12 @@ void delete_partition(struct hd_struct *
+        * "in-use" until we really free the gendisk.
+        */
+       blk_invalidate_devt(part_devt(part));
++
++      bdev = bdget_part(part);
++      if (bdev) {
++              remove_inode_hash(bdev->bd_inode);
++              bdput(bdev);
++      }
+       percpu_ref_kill(&part->ref);
+ }
+ 

diff --git a/queue-5.10/series b/queue-5.10/series
index 67988fd8f16543e4dea424fcfa51943f1fbd61f8..2686b75f6af365a1b9b350f16c307123a7efa4bd 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -89,3 +89,4 @@ acpi-hmat-fix-initiator-registration-for-single-init.patch
 revert-clocksource-drivers-riscv-events-are-stopped-.patch
 char-tpm-protect-tpm_pm_suspend-with-locks.patch
 input-raydium_ts_i2c-fix-memory-leak-in-raydium_i2c_send.patch
+block-unhash-blkdev-part-inode-when-the-part-is-deleted.patch