From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 7 Oct 2023 11:06:47 +0000 (+0200)
Subject: 5.10-stable patches
X-Git-Tag: v4.14.327~76
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8c6e8130622fbf10275f39aa82ae559c9a53c935;p=thirdparty%2Fkernel%2Fstable-queue.git

5.10-stable patches

added patches:
	block-fix-use-after-free-of-q-q_usage_counter.patch
---

diff --git a/queue-5.10/block-fix-use-after-free-of-q-q_usage_counter.patch b/queue-5.10/block-fix-use-after-free-of-q-q_usage_counter.patch
new file mode 100644
index 00000000000..2dbdc462fe1
--- /dev/null
+++ b/queue-5.10/block-fix-use-after-free-of-q-q_usage_counter.patch
@@ -0,0 +1,58 @@
+From d36a9ea5e7766961e753ee38d4c331bbe6ef659b Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@redhat.com>
+Date: Thu, 15 Dec 2022 10:16:29 +0800
+Subject: block: fix use-after-free of q->q_usage_counter
+
+From: Ming Lei <ming.lei@redhat.com>
+
+commit d36a9ea5e7766961e753ee38d4c331bbe6ef659b upstream.
+
+For blk-mq, queue release handler is usually called after
+blk_mq_freeze_queue_wait() returns. However, the
+q_usage_counter->release() handler may not be run yet at that time, so
+this can cause a use-after-free.
+
+Fix the issue by moving percpu_ref_exit() into blk_free_queue_rcu().
+Since ->release() is called with rcu read lock held, it is agreed that
+the race should be covered in caller per discussion from the two links.
+
+Reported-by: Zhang Wensheng <zhangwensheng@huaweicloud.com>
+Reported-by: Zhong Jinghua <zhongjinghua@huawei.com>
+Link: https://lore.kernel.org/linux-block/Y5prfOjyyjQKUrtH@T590/T/#u
+Link: https://lore.kernel.org/lkml/Y4%2FmzMd4evRg9yDi@fedora/
+Cc: Hillf Danton <hdanton@sina.com>
+Cc: Yu Kuai <yukuai3@huawei.com>
+Cc: Dennis Zhou <dennis@kernel.org>
+Fixes: 2b0d3d3e4fcf ("percpu_ref: reduce memory footprint of percpu_ref in fast path")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20221215021629.74870-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Saranya Muruganandam <saranyamohan@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-core.c  |    2 --
+ block/blk-sysfs.c |    2 ++
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -414,8 +414,6 @@ void blk_cleanup_queue(struct request_qu
+ 		blk_mq_sched_free_requests(q);
+ 	mutex_unlock(&q->sysfs_lock);
+ 
+-	percpu_ref_exit(&q->q_usage_counter);
+-
+ 	/* @q is and will stay empty, shutdown and put */
+ 	blk_put_queue(q);
+ }
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -726,6 +726,8 @@ static void blk_free_queue_rcu(struct rc
+ {
+ 	struct request_queue *q = container_of(rcu_head, struct request_queue,
+ 					       rcu_head);
++
++	percpu_ref_exit(&q->q_usage_counter);
+ 	kmem_cache_free(blk_requestq_cachep, q);
+ }
+ 
diff --git a/queue-5.10/series b/queue-5.10/series
index 85ca3f86eff..6dd79580cc9 100644
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -174,3 +174,4 @@ rbd-move-rbd_dev_refresh-definition.patch
 rbd-decouple-header-read-in-from-updating-rbd_dev-he.patch
 rbd-decouple-parent-info-read-in-from-updating-rbd_d.patch
 rbd-take-header_rwsem-in-rbd_dev_refresh-only-when-u.patch
+block-fix-use-after-free-of-q-q_usage_counter.patch