shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-03-29 22:07:43 +09:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'block-5.17-2022-03-04' of git://git.kernel.dk/linux-block

Browse Source 
Pull block fix from Jens Axboe:
 "Just a small UAF fix for blktrace"

* tag 'block-5.17-2022-03-04' of git://git.kernel.dk/linux-block:
  blktrace: fix use after free for struct blk_trace
This commit is contained in:
Linus Torvalds
2022-03-04 16:03:46 -08:00
parent 07ebd38a0d 3093929326
commit ac84e82f78
1 changed files with 18 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
kernel/trace/blktrace.c
View File

@@ -310,10 +310,20 @@ record_it:
local_irq_restore(flags);
}
static void blk_trace_free(struct blk_trace *bt)
static void blk_trace_free(struct request_queue *q, struct blk_trace *bt)
{
relay_close(bt->rchan);
debugfs_remove(bt->dir);
/*
* If 'bt->dir' is not set, then both 'dropped' and 'msg' are created
* under 'q->debugfs_dir', thus lookup and remove them.
*/
if (!bt->dir) {
debugfs_remove(debugfs_lookup("dropped", q->debugfs_dir));
debugfs_remove(debugfs_lookup("msg", q->debugfs_dir));
} else {
debugfs_remove(bt->dir);
}
free_percpu(bt->sequence);
free_percpu(bt->msg_data);
kfree(bt);
@@ -335,10 +345,10 @@ static void put_probe_ref(void)
mutex_unlock(&blk_probe_mutex);
}
static void blk_trace_cleanup(struct blk_trace *bt)
static void blk_trace_cleanup(struct request_queue *q, struct blk_trace *bt)
{
synchronize_rcu();
blk_trace_free(bt);
blk_trace_free(q, bt);
put_probe_ref();
}
@@ -352,7 +362,7 @@ static int __blk_trace_remove(struct request_queue *q)
return -EINVAL;
if (bt->trace_state != Blktrace_running)
blk_trace_cleanup(bt);
blk_trace_cleanup(q, bt);
return 0;
}
@@ -572,7 +582,7 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
ret = 0;
err:
if (ret)
blk_trace_free(bt);
blk_trace_free(q, bt);
return ret;
}
@@ -1616,7 +1626,7 @@ static int blk_trace_remove_queue(struct request_queue *q)
put_probe_ref();
synchronize_rcu();
blk_trace_free(bt);
blk_trace_free(q, bt);
return 0;
}
@@ -1647,7 +1657,7 @@ static int blk_trace_setup_queue(struct request_queue *q,
return 0;
free_bt:
blk_trace_free(bt);
blk_trace_free(q, bt);
return ret;
}