5.15-stable patches

added patches:
	block-fix-use-after-free-of-q-q_usage_counter.patch

diff --git a/queue-5.15/block-fix-use-after-free-of-q-q_usage_counter.patch b/queue-5.15/block-fix-use-after-free-of-q-q_usage_counter.patch
new file mode 100644 (file)
index 0000000..bbb5a8e
--- /dev/null
+++ b/queue-5.15/block-fix-use-after-free-of-q-q_usage_counter.patch
@@ -0,0 +1,58 @@
+From d36a9ea5e7766961e753ee38d4c331bbe6ef659b Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@redhat.com>
+Date: Thu, 15 Dec 2022 10:16:29 +0800
+Subject: block: fix use-after-free of q->q_usage_counter
+
+From: Ming Lei <ming.lei@redhat.com>
+
+commit d36a9ea5e7766961e753ee38d4c331bbe6ef659b upstream.
+
+For blk-mq, queue release handler is usually called after
+blk_mq_freeze_queue_wait() returns. However, the
+q_usage_counter->release() handler may not be run yet at that time, so
+this can cause a use-after-free.
+
+Fix the issue by moving percpu_ref_exit() into blk_free_queue_rcu().
+Since ->release() is called with rcu read lock held, it is agreed that
+the race should be covered in caller per discussion from the two links.
+
+Reported-by: Zhang Wensheng <zhangwensheng@huaweicloud.com>
+Reported-by: Zhong Jinghua <zhongjinghua@huawei.com>
+Link: https://lore.kernel.org/linux-block/Y5prfOjyyjQKUrtH@T590/T/#u
+Link: https://lore.kernel.org/lkml/Y4%2FmzMd4evRg9yDi@fedora/
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Yu Kuai <yukuai3@huawei.com>
+Cc: Dennis Zhou <dennis@kernel.org>
+Fixes: 2b0d3d3e4fcf ("percpu_ref: reduce memory footprint of percpu_ref in fast path")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20221215021629.74870-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Saranya Muruganandam <saranyamohan@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-core.c  |    2 --
+ block/blk-sysfs.c |    2 ++
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -405,8 +405,6 @@ void blk_cleanup_queue(struct request_qu
+               blk_mq_sched_free_requests(q);
+       mutex_unlock(&q->sysfs_lock);
+ 
+-      percpu_ref_exit(&q->q_usage_counter);
+-
+       /* @q is and will stay empty, shutdown and put */
+       blk_put_queue(q);
+ }
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -748,6 +748,8 @@ static void blk_free_queue_rcu(struct rc
+ {
+       struct request_queue *q = container_of(rcu_head, struct request_queue,
+                                              rcu_head);
++
++      percpu_ref_exit(&q->q_usage_counter);
+       kmem_cache_free(blk_requestq_cachep, q);
+ }
+ 

diff --git a/queue-5.15/series b/queue-5.15/series
index fc10a11a589a9487b6d8e6e7b45e8209e52d1c40..f7ab59fe23a445b28b08f7bca38070a0a2fb656c 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -14,3 +14,4 @@ rbd-move-rbd_dev_refresh-definition.patch
 rbd-decouple-header-read-in-from-updating-rbd_dev-he.patch
 rbd-decouple-parent-info-read-in-from-updating-rbd_d.patch
 rbd-take-header_rwsem-in-rbd_dev_refresh-only-when-u.patch
+block-fix-use-after-free-of-q-q_usage_counter.patch