mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Artem Dinaburg <artem@trailofbits.com>
To: stable@vger.kernel.org
Cc: Artem Dinaburg <artem@trailofbits.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Sasha Levin <sashal@kernel.org>, Jens Axboe <axboe@kernel.dk>,
	linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
	Chengming Zhou <zhouchengming@bytedance.com>,
	Ming Lei <ming.lei@redhat.com>, Yi Zhang <yi.zhang@redhat.com>,
	Hannes Reinecke <hare@suse.de>
Subject: [PATCH 6.1.y 0/2] blk-mq: backport CVE-2023-54227 to 6.1.y
Date: Mon, 21 Sep 2026 16:07:24 -0400	[thread overview]
Message-ID: <20260921200728.84114-1-artem@trailofbits.com> (raw)

Hi Greg, Sasha, and block maintainers,

I am continuing with the smaller CVE backports still missing from
6.1.y. This series handles CVE-2023-54227. The first patch frees excess tag
sets after a queue-count reduction. Its immediate upstream follow-up moves
that free past hctx resizing so the repair itself cannot race into a UAF;
they need to travel together.

Both changes are already inherited by v6.6 and every later mainline
release.

Could you please queue the pair for 6.1.y?

Thanks,
Artem Dinaburg

AI assistance: An LLM helped find the missing CVE fix, adapt
it, and prepare the draft; I reviewed the code and build output.

Chengming Zhou (2):
  blk-mq: fix tags leak when shrink nr_hw_queues
  blk-mq: fix tags UAF when shrinking q->nr_hw_queues

 block/blk-mq.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

-- 
2.39.5


             reply	other threads:[~2026-09-21 20:07 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-21 20:07 Artem Dinaburg [this message]
2026-09-21 20:07 ` [PATCH 6.1.y 1/2] blk-mq: fix tags leak when shrink nr_hw_queues Artem Dinaburg
2026-09-21 20:07 ` [PATCH 6.1.y 2/2] blk-mq: fix tags UAF when shrinking q->nr_hw_queues Artem Dinaburg

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260921200728.84114-1-artem@trailofbits.com \
    --to=artem@trailofbits.com \
    --cc=axboe@kernel.dk \
    --cc=gregkh@linuxfoundation.org \
    --cc=hare@suse.de \
    --cc=linux-block@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=ming.lei@redhat.com \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=yi.zhang@redhat.com \
    --cc=zhouchengming@bytedance.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®