6.1-stable patches

added patches:
	block-fix-use-after-free-of-q-q_usage_counter.patch

diff --git a/queue-6.1/block-fix-use-after-free-of-q-q_usage_counter.patch b/queue-6.1/block-fix-use-after-free-of-q-q_usage_counter.patch
new file mode 100644 (file)
index 0000000..3fe3719
--- /dev/null
+++ b/queue-6.1/block-fix-use-after-free-of-q-q_usage_counter.patch
@@ -0,0 +1,54 @@
+From d36a9ea5e7766961e753ee38d4c331bbe6ef659b Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@redhat.com>
+Date: Thu, 15 Dec 2022 10:16:29 +0800
+Subject: block: fix use-after-free of q->q_usage_counter
+
+From: Ming Lei <ming.lei@redhat.com>
+
+commit d36a9ea5e7766961e753ee38d4c331bbe6ef659b upstream.
+
+For blk-mq, queue release handler is usually called after
+blk_mq_freeze_queue_wait() returns. However, the
+q_usage_counter->release() handler may not be run yet at that time, so
+this can cause a use-after-free.
+
+Fix the issue by moving percpu_ref_exit() into blk_free_queue_rcu().
+Since ->release() is called with rcu read lock held, it is agreed that
+the race should be covered in caller per discussion from the two links.
+
+Reported-by: Zhang Wensheng <zhangwensheng@huaweicloud.com>
+Reported-by: Zhong Jinghua <zhongjinghua@huawei.com>
+Link: https://lore.kernel.org/linux-block/Y5prfOjyyjQKUrtH@T590/T/#u
+Link: https://lore.kernel.org/lkml/Y4%2FmzMd4evRg9yDi@fedora/
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Yu Kuai <yukuai3@huawei.com>
+Cc: Dennis Zhou <dennis@kernel.org>
+Fixes: 2b0d3d3e4fcf ("percpu_ref: reduce memory footprint of percpu_ref in fast path")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20221215021629.74870-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Saranya Muruganandam <saranyamohan@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-sysfs.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -737,6 +737,7 @@ static void blk_free_queue_rcu(struct rc
+       struct request_queue *q = container_of(rcu_head, struct request_queue,
+                                              rcu_head);
+ 
++      percpu_ref_exit(&q->q_usage_counter);
+       kmem_cache_free(blk_get_queue_kmem_cache(blk_queue_has_srcu(q)), q);
+ }
+ 
+@@ -762,8 +763,6 @@ static void blk_release_queue(struct kob
+ 
+       might_sleep();
+ 
+-      percpu_ref_exit(&q->q_usage_counter);
+-
+       if (q->poll_stat)
+               blk_stat_remove_callback(q, q->poll_cb);
+       blk_stat_free_callback(q->poll_cb);

diff --git a/queue-6.1/series b/queue-6.1/series
index 4d40ff2ffbe28af8632f954e3a619ffa3168b2a8..292df754dccdde8d7100cfc59320eaf88b4600fe 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -50,3 +50,4 @@ rbd-move-rbd_dev_refresh-definition.patch
 rbd-decouple-header-read-in-from-updating-rbd_dev-he.patch
 rbd-decouple-parent-info-read-in-from-updating-rbd_d.patch
 rbd-take-header_rwsem-in-rbd_dev_refresh-only-when-u.patch
+block-fix-use-after-free-of-q-q_usage_counter.patch