From 3de365be9897285c3894c695fa76ab41328518ed Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 5 Dec 2022 17:36:08 +0100 Subject: [PATCH] 5.10-stable patches added patches: block-unhash-blkdev-part-inode-when-the-part-is-deleted.patch --- ...-part-inode-when-the-part-is-deleted.patch | 65 +++++++++++++++++++ queue-5.10/series | 1 + 2 files changed, 66 insertions(+) create mode 100644 queue-5.10/block-unhash-blkdev-part-inode-when-the-part-is-deleted.patch diff --git a/queue-5.10/block-unhash-blkdev-part-inode-when-the-part-is-deleted.patch b/queue-5.10/block-unhash-blkdev-part-inode-when-the-part-is-deleted.patch new file mode 100644 index 00000000000..f6aaab62608 --- /dev/null +++ b/queue-5.10/block-unhash-blkdev-part-inode-when-the-part-is-deleted.patch @@ -0,0 +1,65 @@ +From ming.lei@redhat.com Mon Dec 5 17:35:21 2022 +From: Ming Lei +Date: Mon, 5 Dec 2022 21:27:39 +0800 +Subject: [PATCH 5.10.y stable v2] block: unhash blkdev part inode when the part is deleted +To: Greg Kroah-Hartman , stable@vger.kernel.org +Cc: Jens Axboe , linux-block@vger.kernel.org, Ming Lei , Shiwei Cui , Christoph Hellwig , Jan Kara +Message-ID: <20221205132739.844399-1-ming.lei@redhat.com> + + +v5.11 changes the blkdev lookup mechanism completely since commit +22ae8ce8b892 ("block: simplify bdev/disk lookup in blkdev_get"), +and small part of the change is to unhash part bdev inode when +deleting partition. Turns out this kind of change does fix one +nasty issue in case of BLOCK_EXT_MAJOR: + +1) when one partition is deleted & closed, disk_put_part() is always +called before bdput(bdev), see blkdev_put(); so the part's devt can +be freed & re-used before the inode is dropped + +2) then new partition with same devt can be created just before the +inode in 1) is dropped, then the old inode/bdev structurein 1) is +re-used for this new partition, this way causes use-after-free and +kernel panic. + +It isn't possible to backport the whole big patchset of "merge struct +block_device and struct hd_struct v4" for addressing this issue. + +https://lore.kernel.org/linux-block/20201128161510.347752-1-hch@lst.de/ + +So fixes it by unhashing part bdev in delete_partition(), and this way +is actually aligned with v5.11+'s behavior. + +Reported-by: Shiwei Cui +Tested-by: Shiwei Cui +Cc: Christoph Hellwig +Cc: Jan Kara +Signed-off-by: Ming Lei +Acked-by: Jens Axboe +--- + block/partitions/core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/block/partitions/core.c ++++ b/block/partitions/core.c +@@ -329,6 +329,7 @@ void delete_partition(struct hd_struct * + struct gendisk *disk = part_to_disk(part); + struct disk_part_tbl *ptbl = + rcu_dereference_protected(disk->part_tbl, 1); ++ struct block_device *bdev; + + /* + * ->part_tbl is referenced in this part's release handler, so +@@ -346,6 +347,12 @@ void delete_partition(struct hd_struct * + * "in-use" until we really free the gendisk. + */ + blk_invalidate_devt(part_devt(part)); ++ ++ bdev = bdget_part(part); ++ if (bdev) { ++ remove_inode_hash(bdev->bd_inode); ++ bdput(bdev); ++ } + percpu_ref_kill(&part->ref); + } + diff --git a/queue-5.10/series b/queue-5.10/series index 67988fd8f16..2686b75f6af 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -89,3 +89,4 @@ acpi-hmat-fix-initiator-registration-for-single-init.patch revert-clocksource-drivers-riscv-events-are-stopped-.patch char-tpm-protect-tpm_pm_suspend-with-locks.patch input-raydium_ts_i2c-fix-memory-leak-in-raydium_i2c_send.patch +block-unhash-blkdev-part-inode-when-the-part-is-deleted.patch -- 2.47.3