diff options
author | Zheng Liang <zhengliang6@huawei.com> | 2021-10-18 05:42:25 +0300 |
---|---|---|
committer | Jens Axboe <axboe@kernel.dk> | 2021-10-20 00:18:30 +0300 |
commit | 2fc428f6b7ca80794cb9928c90d4de524366659f (patch) | |
tree | be8a64de2fcd8220fb80f76058341f1de37da8dd /drivers/nvme | |
parent | a808a9d545cdffb964f27239d1fc0c6e2330b424 (diff) | |
download | linux-2fc428f6b7ca80794cb9928c90d4de524366659f.tar.xz |
block, bfq: fix UAF problem in bfqg_stats_init()
In bfq_pd_alloc(), the function bfqg_stats_init() init bfqg. If
blkg_rwstat_init() init bfqg_stats->bytes successful and init
bfqg_stats->ios failed, bfqg_stats_init() return failed, bfqg will
be freed. But blkg_rwstat->cpu_cnt is not deleted from the list of
percpu_counters. If we traverse the list of percpu_counters, It will
have UAF problem.
we should use blkg_rwstat_exit() to cleanup bfqg_stats bytes in the
above scenario.
Fixes: commit fd41e60331b ("bfq-iosched: stop using blkg->stat_bytes and ->stat_ios")
Signed-off-by: Zheng Liang <zhengliang6@huawei.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/20211018024225.1493938-1-zhengliang6@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'drivers/nvme')
0 files changed, 0 insertions, 0 deletions