Yu Kuai ada4ca5fd5 block, bfq: fix bfqq uaf in bfq_limit_depth() ... commit e8b8344de3 upstream. Set new allocated bfqq to bic or remove freed bfqq from bic are both protected by bfqd->lock, however bfq_limit_depth() is deferencing bfqq from bic without the lock, this can lead to UAF if the io_context is shared by multiple tasks. For example, test bfq with io_uring can trigger following UAF in v6.6: ================================================================== BUG: KASAN: slab-use-after-free in bfqq_group+0x15/0x50 Call Trace: <TASK> dump_stack_lvl+0x47/0x80 print_address_description.constprop.0+0x66/0x300 print_report+0x3e/0x70 kasan_report+0xb4/0xf0 bfqq_group+0x15/0x50 bfqq_request_over_limit+0x130/0x9a0 bfq_limit_depth+0x1b5/0x480 __blk_mq_alloc_requests+0x2b5/0xa00 blk_mq_get_new_requests+0x11d/0x1d0 blk_mq_submit_bio+0x286/0xb00 submit_bio_noacct_nocheck+0x331/0x400 __block_write_full_folio+0x3d0/0x640 writepage_cb+0x3b/0xc0 write_cache_pages+0x254/0x6c0 write_cache_pages+0x254/0x6c0 do_writepages+0x192/0x310 filemap_fdatawrite_wbc+0x95/0xc0 __filemap_fdatawrite_range+0x99/0xd0 filemap_write_and_wait_range.part.0+0x4d/0xa0 blkdev_read_iter+0xef/0x1e0 io_read+0x1b6/0x8a0 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork_asm+0x1b/0x30 </TASK> Allocated by task 808602: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x83/0x90 kmem_cache_alloc_node+0x1b1/0x6d0 bfq_get_queue+0x138/0xfa0 bfq_get_bfqq_handle_split+0xe3/0x2c0 bfq_init_rq+0x196/0xbb0 bfq_insert_request.isra.0+0xb5/0x480 bfq_insert_requests+0x156/0x180 blk_mq_insert_request+0x15d/0x440 blk_mq_submit_bio+0x8a4/0xb00 submit_bio_noacct_nocheck+0x331/0x400 __blkdev_direct_IO_async+0x2dd/0x330 blkdev_write_iter+0x39a/0x450 io_write+0x22a/0x840 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x1b/0x30 Freed by task 808589: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x27/0x40 __kasan_slab_free+0x126/0x1b0 kmem_cache_free+0x10c/0x750 bfq_put_queue+0x2dd/0x770 __bfq_insert_request.isra.0+0x155/0x7a0 bfq_insert_request.isra.0+0x122/0x480 bfq_insert_requests+0x156/0x180 blk_mq_dispatch_plug_list+0x528/0x7e0 blk_mq_flush_plug_list.part.0+0xe5/0x590 __blk_flush_plug+0x3b/0x90 blk_finish_plug+0x40/0x60 do_writepages+0x19d/0x310 filemap_fdatawrite_wbc+0x95/0xc0 __filemap_fdatawrite_range+0x99/0xd0 filemap_write_and_wait_range.part.0+0x4d/0xa0 blkdev_read_iter+0xef/0x1e0 io_read+0x1b6/0x8a0 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x1b/0x30 Fix the problem by protecting bic_to_bfqq() with bfqd->lock. CC: Jan Kara <jack@suse.cz> Fixes: 76f1df88bb ("bfq: Limit number of requests consumed by each cgroup") Signed-off-by: Yu Kuai <yukuai3@huawei.com> Link: https://lore.kernel.org/r/20241129091509.2227136-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Hagar Hemdan <hagarhem@amazon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-03-07 16:56:41 +01:00
..
partitions	partitions: mac: fix handling of bogus partition table	2025-02-21 13:50:05 +01:00
badblocks.c
bdev.c	block: update the stable_writes flag in bdev_add	2024-01-10 17:10:32 +01:00
bfq-cgroup.c	block, bfq: split sync bfq_queues on a per-actuator basis	2025-03-07 16:56:41 +01:00
bfq-iosched.c	block, bfq: fix bfqq uaf in bfq_limit_depth()	2025-03-07 16:56:41 +01:00
bfq-iosched.h	block, bfq: split sync bfq_queues on a per-actuator basis	2025-03-07 16:56:41 +01:00
bfq-wf2q.c
bio-integrity.c	block: initialize integrity buffer to zero before writing it to media	2024-08-03 08:48:53 +02:00
bio.c	block: Fix page refcounts for unaligned buffers in __bio_release_pages()	2024-04-03 15:19:46 +02:00
blk-cgroup-fc-appid.c
blk-cgroup-rwstat.c
blk-cgroup-rwstat.h
blk-cgroup.c	blk-cgroup: Fix class @block_class's subsystem refcount leakage	2025-02-21 13:49:41 +01:00
blk-cgroup.h
blk-core.c	block: Fix where bio IO priority gets set	2024-09-30 16:23:50 +02:00
blk-crypto-fallback.c	blk-crypto: dynamically allocate fallback profile	2023-08-23 17:52:39 +02:00
blk-crypto-internal.h
blk-crypto-profile.c	blk-crypto: use dynamic lock class for blk_crypto_profile::lock	2023-07-23 13:49:21 +02:00
blk-crypto-sysfs.c
blk-crypto.c
blk-flush.c
blk-ia-ranges.c
blk-integrity.c	blk-integrity: register sysfs attributes on struct device	2024-10-17 15:21:48 +02:00
blk-ioc.c
blk-iocost.c	blk-iocost: Avoid using clamp() on inuse in __propagate_weights()	2024-12-19 18:08:57 +01:00
blk-iolatency.c
blk-ioprio.c
blk-ioprio.h
blk-lib.c
blk-map.c	block: fix sanity checks in blk_rq_map_user_bvec	2024-11-08 16:26:45 +01:00
blk-merge.c	block: fix bio_split_rw_at to take zone_write_granularity into account	2024-12-14 19:53:15 +01:00
blk-mq-cpumap.c
blk-mq-debugfs-zoned.c
blk-mq-debugfs.c	blk-mq: fix potential io hang by wrong 'wake_batch'	2023-07-19 16:20:55 +02:00
blk-mq-debugfs.h
blk-mq-pci.c
blk-mq-rdma.c
blk-mq-sched.c
blk-mq-sched.h
blk-mq-sysfs.c
blk-mq-tag.c	block: Fix lockdep warning in blk_mq_mark_tag_wait	2024-08-29 17:30:33 +02:00
blk-mq-tag.h
blk-mq-virtio.c
blk-mq.c	blk-mq: register cpuhp callback after hctx is added to xarray table	2025-01-02 10:30:52 +01:00
blk-mq.h	block: fix ordering between checking BLK_MQ_S_STOPPED request adding	2024-12-14 19:54:04 +01:00
blk-pm.c
blk-pm.h
blk-rq-qos.c	blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race	2024-10-22 15:56:45 +02:00
blk-rq-qos.h
blk-settings.c	block: Clear zone limits for a non-zoned stacked queue	2024-04-03 15:19:27 +02:00
blk-stat.c	block: prevent division by zero in blk_rq_stat_sum()	2024-04-13 13:05:12 +02:00
blk-stat.h
blk-sysfs.c	block: fix uaf for flush rq while iterating tags	2025-01-23 17:17:16 +01:00
blk-throttle.c	blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!"	2023-12-20 17:00:21 +01:00
blk-throttle.h
blk-timeout.c
blk-wbt.c
blk-wbt.h
blk-zoned.c
blk.h	blk-integrity: register sysfs attributes on struct device	2024-10-17 15:21:48 +02:00
bounce.c
bsg-lib.c
bsg.c
disk-events.c	block: increment diskseq on all media change events	2023-07-19 16:21:47 +02:00
elevator.c	block: Fix elevator_get_default() checking for NULL q->tag_set	2024-11-17 15:07:20 +01:00
elevator.h
fops.c	block: don't revert iter for -EIOCBQUEUED	2025-02-21 13:49:45 +01:00
genhd.c	block: retry call probe after request_module in blk_request_module	2025-02-21 13:48:53 +01:00
holder.c
ioctl.c	block: fix integer overflow in BLKSECDISCARD	2025-02-01 18:30:09 +01:00
ioprio.c
Kconfig
Kconfig.iosched
kyber-iosched.c
Makefile
mq-deadline.c	block/mq-deadline: Fix the tag reservation code	2024-08-14 13:53:02 +02:00
opal_proto.h	block: sed-opal: handle empty atoms when parsing response	2024-03-26 18:20:26 -04:00
sed-opal.c	block: sed-opal: handle empty atoms when parsing response	2024-03-26 18:20:26 -04:00
t10-pi.c