[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: 86e6ca55b83c575ab0f2e105cf08f98e58d3d7af
WARNING: Author mismatch between patch and upstream commit:
Backport author: Vasiliy Kovalev<kovalev@xxxxxxxxxxxx>
Commit author: Tejun Heo<tj@xxxxxxxxxx>
Status in newer kernel trees:
6.12.y | Present (different SHA1: 29d1e06560f0)
6.6.y | Present (different SHA1: 5baa28569c92)
6.1.y | Present (different SHA1: 64afc6fe24c9)
5.15.y | Not found
Note: The patch differs from the upstream commit:
---
1: 86e6ca55b83c ! 1: 4a53d2caa691 blk-cgroup: Fix UAF in blkcg_unpin_online()
@@ Metadata
## Commit message ##
blk-cgroup: Fix UAF in blkcg_unpin_online()
+ commit 86e6ca55b83c575ab0f2e105cf08f98e58d3d7af upstream.
+
blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To
walk up, it uses blkcg_parent(blkcg) but it was calling that after
blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the
@@ Commit message
Fixes: 4308a434e5e0 ("blkcg: don't offline parent blkcg first")
Cc: stable@xxxxxxxxxxxxxxx # v5.7+
Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
+ [kovalev: in versions 5.10 and 5.15, the blkcg_unpin_online()
+ function was not moved to the block/blk-cgroup.c file]
+ Signed-off-by: Vasiliy Kovalev <kovalev@xxxxxxxxxxxx>
- ## block/blk-cgroup.c ##
-@@ block/blk-cgroup.c: void blkcg_unpin_online(struct cgroup_subsys_state *blkcg_css)
- struct blkcg *blkcg = css_to_blkcg(blkcg_css);
-
+ ## include/linux/blk-cgroup.h ##
+@@ include/linux/blk-cgroup.h: static inline void blkcg_pin_online(struct blkcg *blkcg)
+ static inline void blkcg_unpin_online(struct blkcg *blkcg)
+ {
do {
+ struct blkcg *parent;
+
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.15.y | Success | Success |
| stable/linux-5.10.y | Success | Success |
