Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: block: don't call rq_qos_ops->done_bio if the bio isn't tracked rq_qos framework is only applied on request based driver, so: 1) rq_qos_done_bio() needn't to be called for bio based driver 2) rq_qos_done_bio() needn't to be called for bio which isn't tracked, such as bios ended from error handling code. Especially in bio_endio(): 1) request queue is referred via bio->bi_bdev->bd_disk->queue, which may be gone since request queue refcount may not be held in above two cases 2) q->rq_qos may be freed in blk_cleanup_queue() when calling into __rq_qos_done_bio() Fix the potential kernel panic by not calling rq_qos_ops->done_bio if the bio isn't tracked. This way is safe because both ioc_rqos_done_bio() and blkcg_iolatency_done_bio() are nop if the bio isn't tracked.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578 before db60edbfff332a6a5477c367af8125f034570989; affected 67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578 before 004b8f8a691205a93d9e80d98b786b2b97424d6e; affected 67b42d0bf7a8fd1ec0cf1acdc9550e688d7c8578 before a647a524a46736786c95cdb553a070322ca096e3 |
| Linux / Linux | affected 4.19; unaffected 0 before 4.19; unaffected 5.10.241 through 5.10.*; unaffected 5.14.11 through 5.14.*; unaffected 5.15 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/db60edbfff332a6a5477c367af8125f034570989
- https://git.kernel.org/stable/c/004b8f8a691205a93d9e80d98b786b2b97424d6e
- https://git.kernel.org/stable/c/a647a524a46736786c95cdb553a070322ca096e3
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.