blk-mq: backport CVE-2023-54227 to 6.1.y

[PATCH 6.1.y 0/2] blk-mq: backport CVE-2023-54227 to 6.1.y

Posted by Artem Dinaburg 2 days, 21 hours ago

Hi Greg, Sasha, and block maintainers,

I am continuing with the smaller CVE backports still missing from
6.1.y. This series handles CVE-2023-54227. The first patch frees excess tag
sets after a queue-count reduction. Its immediate upstream follow-up moves
that free past hctx resizing so the repair itself cannot race into a UAF;
they need to travel together.

Both changes are already inherited by v6.6 and every later mainline
release.

Could you please queue the pair for 6.1.y?

Thanks,
Artem Dinaburg

AI assistance: An LLM helped find the missing CVE fix, adapt
it, and prepare the draft; I reviewed the code and build output.

Chengming Zhou (2):
  blk-mq: fix tags leak when shrink nr_hw_queues
  blk-mq: fix tags UAF when shrinking q->nr_hw_queues

 block/blk-mq.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

-- 
2.39.5

Re: [PATCH 6.1.y 0/2] blk-mq: backport CVE-2023-54227 to 6.1.y

Posted by Sasha Levin 2 days, 1 hour ago

> The first patch frees excess tag
> sets after a queue-count reduction. Its immediate upstream follow-up moves
> that free past hctx resizing so the repair itself cannot race into a UAF;
> they need to travel together.
>
> Could you please queue the pair for 6.1.y?

Queued the pair for 6.1, thanks.

-- 
Thanks,
Sasha