Patch "blk-cgroup: dropping parent refcount after pd_free_fn() is done" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    blk-cgroup: dropping parent refcount after pd_free_fn() is done

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     blk-cgroup-dropping-parent-refcount-after-pd_free_fn.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1baf6b6dc7b03e07aa94ccbc35c5ccbbadfd4775
Author: Yu Kuai <yukuai3@xxxxxxxxxx>
Date:   Thu Jan 19 19:03:48 2023 +0800

    blk-cgroup: dropping parent refcount after pd_free_fn() is done
    
    [ Upstream commit c7241babf0855d8a6180cd1743ff0ec34de40b4e ]
    
    Some cgroup policies will access parent pd through child pd even
    after pd_offline_fn() is done. If pd_free_fn() for parent is called
    before child, then UAF can be triggered. Hence it's better to guarantee
    the order of pd_free_fn().
    
    Currently refcount of parent blkg is dropped in __blkg_release(), which
    is before pd_free_fn() is called in blkg_free_work_fn() while
    blkg_free_work_fn() is called asynchronously.
    
    This patch make sure pd_free_fn() called from removing cgroup is ordered
    by delaying dropping parent refcount after calling pd_free_fn() for
    child.
    
    BTW, pd_free_fn() will also be called from blkcg_deactivate_policy()
    from deleting device, and following patches will guarantee the order.
    
    Signed-off-by: Yu Kuai <yukuai3@xxxxxxxxxx>
    Acked-by: Tejun Heo <tj@xxxxxxxxxx>
    Reviewed-by: Christoph Hellwig <hch@xxxxxx>
    Link: https://lore.kernel.org/r/20230119110350.2287325-2-yukuai1@xxxxxxxxxxxxxxx
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 7c91d9195da8d..8d1b7757f1e4f 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -93,6 +93,8 @@ static void blkg_free_workfn(struct work_struct *work)
 		if (blkg->pd[i])
 			blkcg_policy[i]->pd_free_fn(blkg->pd[i]);
 
+	if (blkg->parent)
+		blkg_put(blkg->parent);
 	if (blkg->q)
 		blk_put_queue(blkg->q);
 	free_percpu(blkg->iostat_cpu);
@@ -127,8 +129,6 @@ static void __blkg_release(struct rcu_head *rcu)
 
 	/* release the blkcg and parent blkg refs this blkg has been holding */
 	css_put(&blkg->blkcg->css);
-	if (blkg->parent)
-		blkg_put(blkg->parent);
 	blkg_free(blkg);
 }