linux-kernel - Re: [PATCH] block, bfq: fix uaf for bfqq in bic_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4d3f6183-f9d4-b657-0205-fc240bc24c76@huaweicloud.com>
Date:   Sun, 29 Jan 2023 09:38:11 +0800
From:   Yu Kuai <yukuai1@...weicloud.com>
To:     jack@...e.cz, tj@...nel.org, josef@...icpanda.com, axboe@...nel.dk,
        paolo.valente@...aro.org, shinichiro.kawasaki@....com
Cc:     cgroups@...r.kernel.org, linux-block@...r.kernel.org,
        linux-kernel@...r.kernel.org, yukuai1@...weicloud.com,
        yi.zhang@...wei.com, yangerkun@...wei.com,
        "yukuai (C)" <yukuai3@...wei.com>
Subject: Re: [PATCH] block, bfq: fix uaf for bfqq in bic_set_bfqq()

Hi, Jens

在 2023/01/13 17:44, Yu Kuai 写道:
> After commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'"),
> bic->bfqq will be accessed in bic_set_bfqq(), however, in some context
> bic->bfqq will be freed first, and bic_set_bfqq() is called with the freed
> bic->bfqq.
> 
> Fix the problem by always freeing bfqq after bic_set_bfqq().
> 

Sorry that I send this patch will wrong email, and you might missed this
patch.

Can you apply this patch? This patch can't be applied directly to lower
version due to Paolo's patchset, I'll send lts patch seperately.

Thanks,
Kuai
> Fixes: 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'")
> Reported-and-tested-by: Shinichiro Kawasaki <shinichiro.kawasaki@....com>
> Signed-off-by: Yu Kuai <yukuai3@...wei.com>