iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/md
History
Wentao_Liang 7470a4314b drivers:md:fix a potential use-after-free bug 
[ Upstream commit 104212471b1c1817b311771d817fb692af983173 ]

In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and
may cause sh to be released. However, sh is subsequently used in lines
2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an
use-after-free bug.

It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of
the function.

Signed-off-by: Wentao_Liang <Wentao_Liang_g@163.com>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-08-25 11:09:31 +02:00
..
bcache
bcache: fix a lost wake-up problem caused by mca_cannibalize_lock
2020-10-01 20:40:03 +02:00
persistent-data
dm space map common: add bounds check to sm_ll_lookup_bitmap()
2022-01-27 08:47:38 +01:00
bitmap.c
md/bitmap: md_bitmap_get_counter returns wrong blocks
2020-11-10 10:23:54 +01:00
bitmap.h
…
dm-bio-prison.c
dm: Use kzalloc for all structs with embedded biosets/mempools
2019-11-06 12:18:01 +01:00
dm-bio-prison.h
…
dm-bio-record.h
…
dm-bufio.c
Revert "dm bufio: fix deadlock with loop device"
2019-09-06 10:19:36 +02:00
dm-bufio.h
…
dm-builtin.c
…
dm-cache-block-types.h
…
dm-cache-metadata.c
dm cache metadata: Avoid returning cmd->bm wild pointer on error
2020-09-12 11:47:37 +02:00
dm-cache-metadata.h
…
dm-cache-policy-cleaner.c
…
dm-cache-policy-internal.h
…
dm-cache-policy-smq.c
…
dm-cache-policy.c
…
dm-cache-policy.h
…
dm-cache-target.c
dm cache: fix a crash due to incorrect work item cancelling
2020-03-11 07:53:14 +01:00
dm-core.h
…
dm-crypt.c
dm crypt: make printing of the key constant-time
2022-06-06 08:19:46 +02:00
dm-delay.c
dm delay: fix a crash when invalid device is specified
2019-05-25 18:26:54 +02:00
dm-era-target.c
dm era: commit metadata in postsuspend after worker stops
2022-07-02 16:17:14 +02:00
dm-exception-store.c
…
dm-exception-store.h
…
dm-flakey.c
dm flakey: check for null arg_name in parse_features()
2020-04-24 07:59:05 +02:00
dm-io.c
dm: Use kzalloc for all structs with embedded biosets/mempools
2019-11-06 12:18:01 +01:00
dm-ioctl.c
dm ioctl: prevent potential spectre v1 gadget
2022-04-20 09:06:42 +02:00
dm-kcopyd.c
dm: Use kzalloc for all structs with embedded biosets/mempools
2019-11-06 12:18:01 +01:00
dm-linear.c
…
dm-log-userspace-base.c
…
dm-log-userspace-transfer.c
…
dm-log-userspace-transfer.h
…
dm-log-writes.c
…
dm-log.c
…
dm-mpath.c
…
dm-mpath.h
…
dm-path-selector.c
…
dm-path-selector.h
…
dm-queue-length.c
…
dm-raid1.c
…
dm-raid.c
dm raid: fix address sanitizer warning in raid_status
2022-08-25 11:09:26 +02:00
dm-region-hash.c
dm: Use kzalloc for all structs with embedded biosets/mempools
2019-11-06 12:18:01 +01:00
dm-round-robin.c
…
dm-rq.c
dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails
2021-05-22 10:40:20 +02:00
dm-rq.h
…
dm-service-time.c
…
dm-snap-persistent.c
block: fix an integer overflow in logical block size
2020-01-23 08:19:38 +01:00
dm-snap-transient.c
…
dm-snap.c
dm snapshot: properly fix a crash when an origin has no snapshots
2021-06-03 08:23:29 +02:00
dm-stats.c
dm stats: add cond_resched when looping over entries
2022-06-06 08:19:46 +02:00
dm-stats.h
…
dm-stripe.c
…
dm-switch.c
…
dm-sysfs.c
…
dm-table.c
dm table: fix DAX iterate_devices based device capability checks
2021-03-11 13:48:03 +01:00
dm-target.c
…
dm-thin-metadata.c
dm thin metadata: Avoid returning cmd->bm wild pointer on error
2020-09-12 11:47:37 +02:00
dm-thin-metadata.h
dm thin: fix passdown_double_checking_shared_status()
2019-01-31 08:12:36 +01:00
dm-thin.c
dm: Use kzalloc for all structs with embedded biosets/mempools
2019-11-06 12:18:01 +01:00
dm-uevent.c
…
dm-uevent.h
…
dm-verity-fec.c
dm verity fec: fix hash block number in verity_fec_decode
2020-05-05 19:14:38 +02:00
dm-verity-fec.h
…
dm-verity-target.c
dm verity: set DM_TARGET_IMMUTABLE feature flag
2022-06-06 08:19:46 +02:00
dm-verity.h
…
dm-zero.c
…
dm.c
dm: interlock pending dm_io and dm_wait_for_bios_completion
2022-05-12 12:14:58 +02:00
dm.h
…
faulty.c
…
Kconfig
…
linear.c
…
linear.h
…
Makefile
…
md-cluster.c
md-cluster: fix wild pointer of unlock_all_bitmaps()
2020-08-21 11:01:58 +02:00
md-cluster.h
…
md.c
md: protect md_unregister_thread from reentrancy
2022-06-14 16:52:40 +02:00
md.h
…
multipath.c
…
multipath.h
…
raid0.c
block: fix an integer overflow in logical block size
2020-01-23 08:19:38 +01:00
raid0.h
…
raid1.c
md: raid1: check rdev before reference in raid1_sync_request func
2020-01-12 11:24:10 +01:00
raid1.h
…
raid5-cache.c
…
raid5.c
drivers:md:fix a potential use-after-free bug
2022-08-25 11:09:31 +02:00
raid5.h
…
raid10.c
md-raid10: fix KASAN warning
2022-08-25 11:09:24 +02:00
raid10.h
…