[ Sasha's backport helper bot ]
Hi,
✅ All tests passed successfully. No issues detected. No action required from the submitter.
The upstream commit SHA1 provided is correct: 8542870237c3a48ff049b6c5df5f50c8728284fa
WARNING: Author mismatch between patch and upstream commit: Backport author: Yu Kuaiyukuai1@huaweicloud.com Commit author: Yu Kuaiyukuai3@huawei.com
Status in newer kernel trees: 6.14.y | Present (different SHA1: 5462544ccbad) 6.13.y | Not found 6.12.y | Not found 6.6.y | Not found
Note: The patch differs from the upstream commit: --- 1: 8542870237c3a ! 1: dd49667d64662 md: fix mddev uaf while iterating all_mddevs list @@ Metadata ## Commit message ## md: fix mddev uaf while iterating all_mddevs list
+ commit 8542870237c3a48ff049b6c5df5f50c8728284fa upstream. + While iterating all_mddevs list from md_notify_reboot() and md_exit(), list_for_each_entry_safe is used, and this can race with deletint the next mddev, causing UAF: @@ Commit message Closes: https://lore.kernel.org/all/Z7Y0SURoA8xwg7vn@bender.morinfr.org/ Signed-off-by: Yu Kuai yukuai3@huawei.com Reviewed-by: Christoph Hellwig hch@lst.de + [skip md_seq_show() that is not exist] + Signed-off-by: Yu Kuai yukuai3@huawei.com
## drivers/md/md.c ## @@ drivers/md/md.c: static void __mddev_put(struct mddev *mddev) @@ drivers/md/md.c: static void __mddev_put(struct mddev *mddev) void mddev_put(struct mddev *mddev) { if (!atomic_dec_and_lock(&mddev->active, &all_mddevs_lock)) -@@ drivers/md/md.c: static int md_seq_show(struct seq_file *seq, void *v) - if (mddev == list_last_entry(&all_mddevs, struct mddev, all_mddevs)) - status_unused(seq); - -- if (atomic_dec_and_test(&mddev->active)) -- __mddev_put(mddev); -- -+ mddev_put_locked(mddev); - return 0; - } - @@ drivers/md/md.c: EXPORT_SYMBOL_GPL(rdev_clear_badblocks); static int md_notify_reboot(struct notifier_block *this, unsigned long code, void *x) ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-6.6.y | Success | Success |