linux-kernel - Re: [PATCH] block, bfq: fix bfqq uaf in bfq_limit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <173289499954.164764.13681710232652992672.b4-ty@kernel.dk>
Date: Fri, 29 Nov 2024 08:43:19 -0700
From: Jens Axboe <axboe@...nel.dk>
To: yukuai3@...wei.com, jack@...e.cz, Yu Kuai <yukuai1@...weicloud.com>
Cc: linux-block@...r.kernel.org, linux-kernel@...r.kernel.org, 
 yi.zhang@...wei.com, yangerkun@...wei.com
Subject: Re: [PATCH] block, bfq: fix bfqq uaf in bfq_limit_depth()


On Fri, 29 Nov 2024 17:15:09 +0800, Yu Kuai wrote:
> Set new allocated bfqq to bic or remove freed bfqq from bic are both
> protected by bfqd->lock, however bfq_limit_depth() is deferencing bfqq
> from bic without the lock, this can lead to UAF if the io_context is
> shared by multiple tasks.
> 
> For example, test bfq with io_uring can trigger following UAF in v6.6:
> 
> [...]

Applied, thanks!

[1/1] block, bfq: fix bfqq uaf in bfq_limit_depth()
      commit: e8b8344de3980709080d86c157d24e7de07d70ad

Best regards,
-- 
Jens Axboe