From: Jens Axboe <axboe@kernel.dk>
To: paolo.valente@linaro.org, jack@suse.cz,
Yu Kuai <yukuai1@huaweicloud.com>
Cc: linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
yukuai3@huawei.com, yi.zhang@huawei.com
Subject: Re: [PATCH v2] block, bfq: fix possible uaf for 'bfqq->bic'
Date: Wed, 14 Dec 2022 09:50:43 -0700 [thread overview]
Message-ID: <167103664344.6701.9808643500961565105.b4-ty@kernel.dk> (raw)
In-Reply-To: <20221214030430.3304151-1-yukuai1@huaweicloud.com>
On Wed, 14 Dec 2022 11:04:30 +0800, Yu Kuai wrote:
> Our test report a uaf for 'bfqq->bic' in 5.10:
>
> ==================================================================
> BUG: KASAN: use-after-free in bfq_select_queue+0x378/0xa30
>
> CPU: 6 PID: 2318352 Comm: fsstress Kdump: loaded Not tainted 5.10.0-60.18.0.50.h602.kasan.eulerosv2r11.x86_64 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58-20220320_160524-szxrtosci10000 04/01/2014
> Call Trace:
> bfq_select_queue+0x378/0xa30
> bfq_dispatch_request+0xe8/0x130
> blk_mq_do_dispatch_sched+0x62/0xb0
> __blk_mq_sched_dispatch_requests+0x215/0x2a0
> blk_mq_sched_dispatch_requests+0x8f/0xd0
> __blk_mq_run_hw_queue+0x98/0x180
> __blk_mq_delay_run_hw_queue+0x22b/0x240
> blk_mq_run_hw_queue+0xe3/0x190
> blk_mq_sched_insert_requests+0x107/0x200
> blk_mq_flush_plug_list+0x26e/0x3c0
> blk_finish_plug+0x63/0x90
> __iomap_dio_rw+0x7b5/0x910
> iomap_dio_rw+0x36/0x80
> ext4_dio_read_iter+0x146/0x190 [ext4]
> ext4_file_read_iter+0x1e2/0x230 [ext4]
> new_sync_read+0x29f/0x400
> vfs_read+0x24e/0x2d0
> ksys_read+0xd5/0x1b0
> do_syscall_64+0x33/0x40
> entry_SYSCALL_64_after_hwframe+0x61/0xc6
>
> [...]
Applied, thanks!
[1/1] block, bfq: fix possible uaf for 'bfqq->bic'
commit: 64dc8c732f5c2b406cc752e6aaa1bd5471159cab
Best regards,
--
Jens Axboe
prev parent reply other threads:[~2022-12-14 16:50 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-14 3:04 [PATCH v2] block, bfq: fix possible uaf for 'bfqq->bic' Yu Kuai
2022-12-14 15:54 ` Jan Kara
2022-12-14 16:50 ` Jens Axboe [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=167103664344.6701.9808643500961565105.b4-ty@kernel.dk \
--to=axboe@kernel.dk \
--cc=jack@suse.cz \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=paolo.valente@linaro.org \
--cc=yi.zhang@huawei.com \
--cc=yukuai1@huaweicloud.com \
--cc=yukuai3@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox