Unverified Commit 5513d11e authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!8099 Fix CVE-2023-52854 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zheng Zucheng <zhengzucheng@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/FEZYBJDAB4P33WQU4OMPMYPRKERYQZVE/ 
Fix CVE-2023-52854

WangJinchao (1):
  padata: Fix refcnt handling in padata_free_shell()

Xiyu Yang (1):
  padata: Convert from atomic_t to refcount_t on parallel_data->refcnt


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I9RQM3 
 
Link:https://gitee.com/openeuler/kernel/pulls/8099

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Reviewed-by: default avatarZucheng Zheng <zhengzucheng@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 58e37bc2 8dbb02f1

include/linux/padata.h

+2 −1
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 
#ifndef PADATA_H

#define PADATA_H



#include <linux/refcount.h>

#include <linux/compiler_types.h>

#include <linux/workqueue.h>

#include <linux/spinlock.h>
@@ -96,7 +97,7 @@ struct parallel_data { 
	struct padata_shell		*ps;

	struct padata_list		__percpu *reorder_list;

	struct padata_serial_queue	__percpu *squeue;

	atomic_t			refcnt;

	refcount_t			refcnt;

	unsigned int			seq_nr;

	unsigned int			processed;

	int				cpu;

kernel/padata.c

+9 −5
Original line number Diff line number Diff line
@@ -211,7 +211,7 @@ int padata_do_parallel(struct padata_shell *ps, 
	if ((pinst->flags & PADATA_RESET))

		goto out;



	atomic_inc(&pd->refcnt);

	refcount_inc(&pd->refcnt);

	padata->pd = pd;

	padata->cb_cpu = *cb_cpu;
@@ -383,7 +383,7 @@ static void padata_serial_worker(struct work_struct *serial_work) 
	}

	local_bh_enable();



	if (atomic_sub_and_test(cnt, &pd->refcnt))

	if (refcount_sub_and_test(cnt, &pd->refcnt))

		padata_free_pd(pd);

}
@@ -593,7 +593,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_shell *ps) 
	padata_init_reorder_list(pd);

	padata_init_squeues(pd);

	pd->seq_nr = -1;

	atomic_set(&pd->refcnt, 1);

	refcount_set(&pd->refcnt, 1);

	spin_lock_init(&pd->lock);

	pd->cpu = cpumask_first(pd->cpumask.pcpu);

	INIT_WORK(&pd->reorder_work, invoke_padata_reorder);
@@ -667,7 +667,7 @@ static int padata_replace(struct padata_instance *pinst) 
	synchronize_rcu();



	list_for_each_entry_continue_reverse(ps, &pinst->pslist, list)

		if (atomic_dec_and_test(&ps->opd->refcnt))

		if (refcount_dec_and_test(&ps->opd->refcnt))

			padata_free_pd(ps->opd);



	pinst->flags &= ~PADATA_RESET;
@@ -1102,12 +1102,16 @@ EXPORT_SYMBOL(padata_alloc_shell); 
 */

void padata_free_shell(struct padata_shell *ps)

{

	struct parallel_data *pd;



	if (!ps)

		return;



	mutex_lock(&ps->pinst->lock);

	list_del(&ps->list);

	padata_free_pd(rcu_dereference_protected(ps->pd, 1));

	pd = rcu_dereference_protected(ps->pd, 1);

	if (refcount_dec_and_test(&pd->refcnt))

		padata_free_pd(pd);

	mutex_unlock(&ps->pinst->lock);



	kfree(ps);