In bcache_device_free(), pointer disk is referenced still in
ida_simple_remove() after blk_cleanup_disk() gets called on this
pointer. This may cause a potential panic by use-after-free on the
disk pointer.
This patch fixes the problem by calling blk_cleanup_disk() after
ida_simple_remove().
Fixes: bc70852fd104 ("bcache: convert to blk_alloc_disk/blk_cleanup_disk")
Signed-off-by: Coly Li <colyli(a)suse.de>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Hannes Reinecke <hare(a)suse.de>
Cc: Ulf Hansson <ulf.hansson(a)linaro.org>
Cc: stable(a)vger.kernel.org # v5.14+
---
drivers/md/bcache/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 4a9a65dff95e..86b9e355c583 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -885,9 +885,9 @@ static void bcache_device_free(struct bcache_device *d)
bcache_device_detach(d);
if (disk) {
- blk_cleanup_disk(disk);
ida_simple_remove(&bcache_device_idx,
first_minor_to_idx(disk->first_minor));
+ blk_cleanup_disk(disk);
}
bioset_exit(&d->bio_split);
--
2.31.1
Upstream commit 041c61488236a5a84789083e3d9f0a51139b6edf
Initially this just fixed 50G and 100G modes which felt rare enough to
not apply this to stable (also it got merged before I really had
thought about it).
The testing mentioned in the change was actually from my development
of c62041c5ba ("sfc: Export fibre-specific supported link modes"). I
failed to mention the link between the two changes however and this
commit ended up in net-next (just merged) while the second ended up in
5.15 via the net branch. The result is that for 5.15 even 10G cards
only show 1G as supported:
$ ethtool ext
Settings for ext:
Supported ports: [ FIBRE ]
Supported link modes: 1000baseT/Full
Supported pause frame use: Symmetric Receive-only
[..]
So this commit is needed at least for 5.15 to fix that.
Fixes: c62041c5ba ("sfc: Export fibre-specific supported link modes")
It can also be applied further back if we want to fix the 50/100G
modes (from v4.16 I believe):
Fixes: 5abb5e7f916 ("sfc: add bits for 25/50/100G supported/advertised speeds")
Thanks/
Erik