summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorYu Kuai <yukuai3@huawei.com>2022-12-26 11:06:05 +0800
committerJens Axboe <axboe@kernel.dk>2022-12-26 12:09:56 -0700
commit246cf66e300b76099b5dbd3fdd39e9a5dbc53f02 (patch)
tree710ae2b27578858542cd8aee3e86e8a4d557b650
parentfb857b0bb2c7eea22a896c53c849a75437d24ea8 (diff)
downloadlinux-246cf66e300b76099b5dbd3fdd39e9a5dbc53f02.tar.bz2
block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq
Commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") will access 'bic->bfqq' in bic_set_bfqq(), however, bfq_exit_icq_bfqq() can free bfqq first, and then call bic_set_bfqq(), which will cause uaf. Fix the problem by moving bfq_exit_bfqq() behind bic_set_bfqq(). Fixes: 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") Reported-by: Yi Zhang <yi.zhang@redhat.com> Signed-off-by: Yu Kuai <yukuai3@huawei.com> Link: https://lore.kernel.org/r/20221226030605.1437081-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
-rw-r--r--block/bfq-iosched.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 16f43bbc575a..ccf2204477a5 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -5317,8 +5317,8 @@ static void bfq_exit_icq_bfqq(struct bfq_io_cq *bic, bool is_sync)
unsigned long flags;
spin_lock_irqsave(&bfqd->lock, flags);
- bfq_exit_bfqq(bfqd, bfqq);
bic_set_bfqq(bic, NULL, is_sync);
+ bfq_exit_bfqq(bfqd, bfqq);
spin_unlock_irqrestore(&bfqd->lock, flags);
}
}