Chengming Zhou 6be6d11241 blk-mq: fix tags UAF when shrinking q->nr_hw_queues ...

When nr_hw_queues shrink, we free the excess tags before realloc'ing
hw_ctxs for each queue. During that resize, we may need to access those
tags, like blk_mq_tag_idle(hctx) will access queue shared tags.

This can cause a slab use-after-free, as reported by KASAN. Fix it by
moving the releasing of excess tags to the end.

Fixes: e1dd7bc930 ("blk-mq: fix tags leak when shrink nr_hw_queues")
Reported-by: Yi Zhang <[email protected]>
Closes: https://lore.kernel.org/all/CAHj4cs_CK63uoDpGBGZ6DN4OCTpzkR3UaVgK=LX8Owr8ej2ieQ@mail.gmail.com/
Cc: Ming Lei <[email protected]>
Signed-off-by: Chengming Zhou <[email protected]>
Reviewed-by: Hannes Reinecke <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jens Axboe <[email protected]>

2023-09-11 16:17:34 -06:00

..

partitions

Merge tag 'for-6.6/block-2023-08-28' of git://git.kernel.dk/linux

2023-08-29 20:21:42 -07:00

badblocks.c

…

bdev.c

Merge tag 'vfs-6.6-merge-2' of ssh://gitolite.kernel.org/pub/scm/fs/xfs/xfs-linux

2023-08-23 13:06:55 +02:00

bfq-cgroup.c

blkcg: Restructure blkg_conf_prep() and friends

2023-04-13 06:46:49 -06:00

bfq-iosched.c

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2023-06-30 11:57:07 -07:00

bfq-iosched.h

block, bfq: remove BFQ_WEIGHT_LEGACY_DFL

2023-04-06 16:17:32 -06:00

bfq-wf2q.c

block, bfq: inject I/O to underutilized actuators

2023-01-29 15:18:33 -07:00

bio-integrity.c

bio-integrity: create multi-page bvecs in bio_integrity_add_page()

2023-08-09 16:05:35 -06:00

bio.c

block: Bring back zero_fill_bio_iter

2023-08-14 15:40:42 -06:00

blk-cgroup-fc-appid.c

block: Replace all non-returning strlcpy with strscpy

2023-06-01 09:13:31 -06:00

blk-cgroup-rwstat.c

Revert "blk-cgroup: pin the gendisk in struct blkcg_gq"

2023-02-14 14:24:09 -07:00

blk-cgroup-rwstat.h

…

blk-cgroup.c

Merge tag 'for-6.6/block-2023-08-28' of git://git.kernel.dk/linux

2023-08-29 20:21:42 -07:00

blk-cgroup.h

Merge tag 'for-6.4/block-2023-04-21' of git://git.kernel.dk/linux

2023-04-26 12:52:58 -07:00

blk-core.c

Merge tag 'for-6.6/block-2023-08-28' of git://git.kernel.dk/linux

2023-08-29 20:21:42 -07:00

blk-crypto-fallback.c

blk-crypto: dynamically allocate fallback profile

2023-08-18 15:00:39 -06:00

blk-crypto-internal.h

blk-crypto: remove blk_crypto_insert_cloned_request()

2023-03-16 09:35:09 -06:00

blk-crypto-profile.c

blk-crypto: use dynamic lock class for blk_crypto_profile::lock

2023-07-05 16:36:12 -06:00

blk-crypto-sysfs.c

block: make kobj_type structures constant

2023-02-09 09:38:16 -07:00

blk-crypto.c

blk-crypto: make blk_crypto_evict_key() more robust

2023-03-16 09:35:09 -06:00

blk-flush.c

blk-flush: reuse rq queuelist in flush state machine

2023-07-17 08:18:21 -06:00

blk-ia-ranges.c

block: make kobj_type structures constant

2023-02-09 09:38:16 -07:00

blk-integrity.c

blk-integrity: register sysfs attributes on struct device

2023-04-26 18:22:50 -06:00

blk-ioc.c

blk-ioc: fix recursive spin_lock/unlock_irq() in ioc_clear_queue()

2023-06-07 07:51:00 -06:00

blk-iocost.c

blk-iocost: fix queue stats accounting

2023-08-09 16:04:14 -06:00

blk-iolatency.c

block: fix bad lockdep annotation in blk-iolatency

2023-08-10 17:24:53 -06:00

blk-ioprio.c

blk-ioprio: Introduce promote-to-rt policy

2023-06-06 22:26:26 -06:00

blk-ioprio.h

blk-ioprio: pass a gendisk to blk_ioprio_init and blk_ioprio_exit

2022-09-26 19:09:31 -06:00

blk-lib.c

blk-lib: fix blkdev_issue_secure_erase

2022-09-15 00:25:17 -06:00

blk-map.c

block: fix pin count management when merging same-page segments

2023-09-06 07:32:27 -06:00

blk-merge.c

blk-mq: release crypto keyslot before reporting I/O complete

2023-03-16 09:35:09 -06:00

blk-mq-cpumap.c

blk-mq: include <linux/blk-mq.h> in block/blk-mq.h

2023-04-13 06:52:29 -06:00

blk-mq-debugfs-zoned.c

…

blk-mq-debugfs.c

blk-mq: fix potential io hang by wrong 'wake_batch'

2023-06-12 09:55:53 -06:00

blk-mq-debugfs.h

…

blk-mq-pci.c

blk-mq: include <linux/blk-mq.h> in block/blk-mq.h

2023-04-13 06:52:29 -06:00

blk-mq-sched.c

blk-mq: cleanup __blk_mq_sched_dispatch_requests

2023-04-13 06:57:18 -06:00

blk-mq-sched.h

blk-mq: make sure elevator callbacks aren't called for passthrough request

2023-05-18 19:42:54 -06:00

blk-mq-sysfs.c

blk-mq: include <linux/blk-mq.h> in block/blk-mq.h

2023-04-13 06:52:29 -06:00

blk-mq-tag.c

Merge tag 'for-6.5/block-2023-06-23' of git://git.kernel.dk/linux

2023-06-26 12:47:20 -07:00

blk-mq-virtio.c

blk-mq: include <linux/blk-mq.h> in block/blk-mq.h

2023-04-13 06:52:29 -06:00

blk-mq.c

blk-mq: fix tags UAF when shrinking q->nr_hw_queues

2023-09-11 16:17:34 -06:00

blk-mq.h

blk-mq: fix potential io hang by wrong 'wake_batch'

2023-06-12 09:55:53 -06:00

blk-pm.c

blk-mq: include <linux/blk-mq.h> in block/blk-mq.h

2023-04-13 06:52:29 -06:00

blk-pm.h

…

blk-rq-qos.c

block/rq_qos: protect rq_qos apis with a new lock

2023-05-23 11:13:19 -06:00

blk-rq-qos.h

blk-iolatency: s/blkcg_rq_qos/iolat_rq_qos/

2023-04-13 06:46:49 -06:00

blk-settings.c

block: don't allow enabling a cache on devices that don't support it

2023-07-17 08:18:18 -06:00

blk-stat.c

blk-mq: include <linux/blk-mq.h> in block/blk-mq.h

2023-04-13 06:52:29 -06:00

blk-stat.h

…

blk-sysfs.c

block: don't allow enabling a cache on devices that don't support it

2023-07-17 08:18:18 -06:00

blk-throttle.c

blk-throttle: consider 'carryover_ios/bytes' in throtl_trim_slice()

2023-08-30 10:15:01 -06:00

blk-throttle.h

blk-throttle: print signed value 'carryover_bytes/ios' for user

2023-08-30 10:15:01 -06:00

blk-timeout.c

…

blk-wbt.c

Merge branch 'for-6.5/block-late' into block-6.5

2023-06-28 16:08:19 -06:00

blk-wbt.h

blk-wbt: don't create wbt sysfs entry if CONFIG_BLK_WBT is disabled

2023-06-26 09:53:36 -06:00

blk-zoned.c

Merge branch '6.5/scsi-staging' into 6.5/scsi-fixes

2023-07-11 12:15:15 -04:00

blk.h

block: Add some exports for bcachefs

2023-08-14 15:40:42 -06:00

bounce.c

block: change the blk_queue_bounce calling convention

2022-08-02 17:22:54 -06:00

bsg-lib.c

scsi: replace the fmode_t argument to ->sg_io_fn with a simple bool

2023-06-12 08:04:04 -06:00

bsg.c

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2023-06-30 11:57:07 -07:00

disk-events.c

block: consolidate __invalidate_device and fsync_bdev

2023-08-21 14:35:31 +02:00

early-lookup.c

block: don't return -EINVAL for not found names in devt_from_devname

2023-06-22 09:09:33 -06:00

elevator.c

blk-mq: release scheduler resource when request completes

2023-08-19 07:47:17 -06:00

elevator.h

blk-mq: pass a flags argument to elevator_type->insert_requests

2023-04-13 06:52:30 -06:00

fops.c

block: remove the call to file_remove_privs in blkdev_write_iter

2023-08-31 08:00:23 -06:00

genhd.c

block: call into the file system for bdev_mark_dead

2023-08-21 14:35:32 +02:00

holder.c

block: don't allow a disk link holder to itself

2022-11-16 15:19:56 -07:00

ioctl.c

block: don't add or resize partition on the disk with GENHD_FL_NO_PART

2023-08-31 08:00:35 -06:00

ioprio.c

scsi: block: Improve ioprio value validity checks

2023-06-16 12:04:30 -04:00

Kconfig

block: sed-opal: keyring support for SED keys

2023-08-22 11:10:26 -06:00

Kconfig.iosched

block: Default to use cgroup support for BFQ

2023-01-30 09:42:42 -07:00

kyber-iosched.c

blk-mq: pass a flags argument to elevator_type->insert_requests

2023-04-13 06:52:30 -06:00

Makefile

block: move the code to do early boot lookup of block devices to block/

2023-06-05 10:57:40 -06:00

mq-deadline.c

block/mq-deadline: use correct way to throttling write requests

2023-08-08 15:46:41 -06:00

opal_proto.h

block: sed-opal: Implement IOC_OPAL_REVERT_LSP

2023-08-22 11:10:26 -06:00

sed-opal.c

block: sed-opal: keyring support for SED keys

2023-08-22 11:10:26 -06:00

t10-pi.c

…