From: Guixin Liu kanie@linux.alibaba.com
[ Upstream commit 1e95c798d8a7f70965f0f88d4657b682ff0ec75f ]
Currently, this does not cause any issues, but I believe it is necessary to set bsg_queue to NULL after removing it to prevent potential use-after-free (UAF) access.
Signed-off-by: Guixin Liu kanie@linux.alibaba.com Link: https://lore.kernel.org/r/20241218014214.64533-3-kanie@linux.alibaba.com Reviewed-by: Avri Altman avri.altman@wdc.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Xiangyu Chen xiangyu.chen@windriver.com Signed-off-by: He Zhe zhe.he@windriver.com --- Verified the build test. --- drivers/scsi/ufs/ufs_bsg.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/ufs/ufs_bsg.c b/drivers/scsi/ufs/ufs_bsg.c index 16e8ddcf22fe..b8bbfd81b8ae 100644 --- a/drivers/scsi/ufs/ufs_bsg.c +++ b/drivers/scsi/ufs/ufs_bsg.c @@ -175,6 +175,7 @@ void ufs_bsg_remove(struct ufs_hba *hba) return;
bsg_remove_queue(hba->bsg_queue); + hba->bsg_queue = NULL;
device_del(bsg_dev); put_device(bsg_dev);
[ Sasha's backport helper bot ]
Hi,
✅ All tests passed successfully. No issues detected. No action required from the submitter.
The upstream commit SHA1 provided is correct: 1e95c798d8a7f70965f0f88d4657b682ff0ec75f
WARNING: Author mismatch between patch and upstream commit: Backport author: Xiangyu Chenxiangyu.chen@eng.windriver.com Commit author: Guixin Liukanie@linux.alibaba.com
Status in newer kernel trees: 6.14.y | Present (exact SHA1) 6.13.y | Present (different SHA1: 9193bdc170cc) 6.12.y | Present (different SHA1: 88a01e9c9ad4) 6.6.y | Present (different SHA1: 5f782d4741bf) 6.1.y | Present (different SHA1: 5e7b6e44468c) 5.15.y | Not found
Note: The patch differs from the upstream commit: --- 1: 1e95c798d8a7f ! 1: be0ecc3eb507b scsi: ufs: bsg: Set bsg_queue to NULL after removal @@ Metadata ## Commit message ## scsi: ufs: bsg: Set bsg_queue to NULL after removal
+ [ Upstream commit 1e95c798d8a7f70965f0f88d4657b682ff0ec75f ] + Currently, this does not cause any issues, but I believe it is necessary to set bsg_queue to NULL after removing it to prevent potential use-after-free (UAF) access. @@ Commit message Link: https://lore.kernel.org/r/20241218014214.64533-3-kanie@linux.alibaba.com Reviewed-by: Avri Altman avri.altman@wdc.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com + Signed-off-by: Xiangyu Chen xiangyu.chen@windriver.com + Signed-off-by: He Zhe zhe.he@windriver.com
- ## drivers/ufs/core/ufs_bsg.c ## -@@ drivers/ufs/core/ufs_bsg.c: void ufs_bsg_remove(struct ufs_hba *hba) + ## drivers/scsi/ufs/ufs_bsg.c ## +@@ drivers/scsi/ufs/ufs_bsg.c: void ufs_bsg_remove(struct ufs_hba *hba) return;
bsg_remove_queue(hba->bsg_queue); ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-5.10.y | Success | Success | | stable/linux-5.15.y | Success | Success |
linux-stable-mirror@lists.linaro.org
-
Sasha Levin -
Xiangyu Chen