torvalds/linux
3
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-03-22 07:27:12 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
ea87e6c40a79de84cc2c6186eafb476be79916e0
linux/kernel
History
Herbert Xu 71203f68c7 padata: Fix pd UAF once and for all 
There is a race condition/UAF in padata_reorder that goes back
to the initial commit.  A reference count is taken at the start
of the process in padata_do_parallel, and released at the end in
padata_serial_worker.

This reference count is (and only is) required for padata_replace
to function correctly.  If padata_replace is never called then
there is no issue.

In the function padata_reorder which serves as the core of padata,
as soon as padata is added to queue->serial.list, and the associated
spin lock released, that padata may be processed and the reference
count on pd would go away.

Fix this by getting the next padata before the squeue->serial lock
is released.

In order to make this possible, simplify padata_reorder by only
calling it once the next padata arrives.

Fixes: 16295bec63 ("padata: Generic parallelization/serialization interface")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-06-13 17:26:16 +08:00
..
bpf
Merge tag 'mm-stable-2025-05-31-14-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-05-31 15:44:16 -07:00
cgroup
Merge tag 'cgroup-for-6.16-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2025-06-03 14:12:36 -07:00
configs
Merge tag 'kbuild-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
2025-06-07 10:05:35 -07:00
debug
Merge tag 'tty-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
2025-04-02 18:17:33 -07:00
dma
Merge tag 'dma-mapping-6.16-2025-05-26' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux
2025-05-27 20:09:06 -07:00
entry
entry: Inline syscall_exit_to_user_mode()
2025-04-29 08:27:10 +02:00
events
Merge tag 'mm-stable-2025-05-31-14-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-05-31 15:44:16 -07:00
futex
Merge tag 'mm-stable-2025-06-01-14-06' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-06-02 16:00:26 -07:00
gcov
kbuild: require gcc-8 and binutils-2.30
2025-04-30 21:53:35 +02:00
irq
Merge tag 'irq-msi-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2025-05-27 08:15:26 -07:00
kcsan
treewide, timers: Rename destroy_timer_on_stack() as timer_destroy_on_stack()
2025-05-08 19:49:33 +02:00
livepatch
sched,livepatch: Untangle cond_resched() and live-patching
2025-05-14 13:16:24 +02:00
locking
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
2025-06-02 12:24:58 -07:00
module
Merge tag 'kbuild-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
2025-06-07 10:05:35 -07:00
power
Merge tag 'mm-stable-2025-05-31-14-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-05-31 15:44:16 -07:00
printk
Merge tag 'printk-for-6.15' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux
2025-03-27 19:22:24 -07:00
rcu
treewide, timers: Rename from_timer() to timer_container_of()
2025-06-08 09:07:37 +02:00
sched
treewide, timers: Rename from_timer() to timer_container_of()
2025-06-08 09:07:37 +02:00
time
treewide, timers: Rename from_timer() to timer_container_of()
2025-06-08 09:07:37 +02:00
trace
Merge tag 'trace-v6.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
2025-06-08 08:19:01 -07:00
.gitignore
…
acct.c
acct: block access to kernel internal filesystems
2025-02-12 12:24:16 +01:00
async.c
…
audit_fsnotify.c
…
audit_tree.c
fsnotify: create a wrapper fsnotify_find_inode_mark()
2024-04-04 16:24:16 +02:00
audit_watch.c
fs: add kern_path_locked_negative()
2025-04-15 11:32:34 +02:00
audit.c
audit: record AUDIT_ANOM_* events regardless of presence of rules
2025-04-11 14:14:41 -04:00
audit.h
audit: change context data from secid to lsm_prop
2024-10-11 14:34:16 -04:00
auditfilter.c
audit: fix suffixed '/' filename matching
2024-12-05 19:22:38 -05:00
auditsc.c
fs: dedup handling of struct filename init and refcounts bumps
2025-03-18 15:34:27 +01:00
backtracetest.c
backtracetest: add MODULE_DESCRIPTION()
2024-06-24 22:24:55 -07:00
bounds.c
bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
2024-04-29 08:29:29 -07:00
capability.c
capability: Remove unused has_capability
2025-03-07 22:03:09 -06:00
cfi.c
Merge tag 'modules-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux
2025-03-30 15:44:36 -07:00
compat.c
…
configs.c
…
context_tracking.c
context_tracking: Make RCU watch ct_kernel_exit_state() warning
2025-03-04 18:44:29 -08:00
cpu_pm.c
…
cpu.c
perf: Remove too early and redundant CPU hotplug handling
2025-05-08 21:50:19 +02:00
crash_core.c
crash: Use note name macros
2025-02-10 16:56:58 -08:00
crash_dump_dm_crypt.c
crash_dump: retrieve dm crypt keys in kdump kernel
2025-05-21 10:48:21 -07:00
crash_reserve.c
crash: fix spelling mistake "crahskernel" -> "crashkernel"
2025-05-11 17:54:10 -07:00
cred.c
cred: remove old {override,revert}_creds() helpers
2024-12-02 11:25:09 +01:00
delayacct.c
delayacct: remove redundant code and adjust indentation
2025-05-27 19:40:33 -07:00
dma.c
…
elfcorehdr.c
crash: remove dependency of FA_DUMP on CRASH_DUMP
2024-02-23 17:48:22 -08:00
exec_domain.c
…
exit.c
Merge tag 'mm-nonmm-stable-2025-05-31-15-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-05-31 19:12:53 -07:00
exit.h
…
extable.c
…
fail_function.c
…
fork.c
Merge tag 'mm-stable-2025-05-31-14-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-05-31 15:44:16 -07:00
freezer.c
sched/fair: Fix external p->on_rq users
2024-10-14 09:14:35 +02:00
gen_kheaders.sh
Revert "kheaders: Ignore silly-rename files"
2025-03-15 21:22:52 +09:00
groups.c
…
hung_task.c
hung_task: show the blocker task if the task is hung on semaphore
2025-05-11 17:54:08 -07:00
iomem.c
mm/memremap: Pass down MEMREMAP_* flags to arch_memremap_wb()
2025-02-21 15:05:38 +01:00
irq_work.c
kasan: make kasan_record_aux_stack_noalloc() the default behaviour
2025-01-13 22:40:36 -08:00
jump_label.c
jump_label: Use RCU in all users of __module_text_address().
2025-03-10 11:54:46 +01:00
kallsyms_internal.h
kallsyms: get rid of code for absolute kallsyms
2024-07-20 16:33:21 +09:00
kallsyms_selftest.c
kallsyms: Use kthread_run_on_cpu()
2025-01-02 22:12:12 +01:00
kallsyms_selftest.h
…
kallsyms.c
kallsyms: Remove KALLSYMS_ABSOLUTE_PERCPU
2025-02-18 10:16:04 +01:00
kcmp.c
kcmp: improve performance adding an unlikely hint to task comparisons
2025-02-21 10:25:33 +01:00
Kconfig.freezer
…
Kconfig.hz
kernel: Fix "select" wording on HZ_250 description
2025-02-21 09:20:30 +01:00
Kconfig.kexec
Merge tag 'mm-nonmm-stable-2025-05-31-15-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-05-31 19:12:53 -07:00
Kconfig.locks
…
Kconfig.preempt
sched: No PREEMPT_RT=y for all{yes,mod}config
2024-11-07 15:25:05 +01:00
kcov.c
kcov: mark in_softirq_really() as __always_inline
2024-12-30 17:59:08 -08:00
kexec_core.c
kexec: define functions to map and unmap segments
2025-04-29 15:54:53 -04:00
kexec_elf.c
kexec: initialize ELF lowest address to ULONG_MAX
2025-03-16 22:30:47 -07:00
kexec_file.c
Merge tag 'mm-nonmm-stable-2025-05-31-15-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-05-31 19:12:53 -07:00
kexec_handover.c
kexec: add KHO support to kexec file loads
2025-05-12 23:50:40 -07:00
kexec_internal.h
kexec: add KHO support to kexec file loads
2025-05-12 23:50:40 -07:00
kexec.c
crash: add a new kexec flag for hotplug support
2024-04-23 14:59:01 +10:00
kheaders.c
kheaders: Simplify attribute through __BIN_ATTR_SIMPLE_RO()
2024-12-24 09:46:49 +01:00
kprobes.c
kprobes: Use RCU in all users of __module_text_address().
2025-03-10 11:54:46 +01:00
ksyms_common.c
…
ksysfs.c
kernel/ksysfs.c: simplify bin_attribute definition
2025-01-07 16:59:15 +01:00
kthread.c
treewide, timers: Rename from_timer() to timer_container_of()
2025-06-08 09:07:37 +02:00
latencytop.c
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
Makefile
Merge tag 'mm-nonmm-stable-2025-05-31-15-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-05-31 19:12:53 -07:00
module_signature.c
…
notifier.c
reboot: move reboot_notifier_list to kernel/reboot.c
2024-11-05 17:12:31 -08:00
nsproxy.c
kernel/nsproxy: remove unnecessary guards
2025-05-09 13:13:54 +02:00
padata.c
padata: Fix pd UAF once and for all
2025-06-13 17:26:16 +08:00
panic.c
Merge tag 'mm-nonmm-stable-2025-05-31-15-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-05-31 19:12:53 -07:00
params.c
module: ensure that kobject_put() is safe for module type kobjects
2025-05-07 20:24:59 +02:00
pid_namespace.c
pid: Do not set pid_max in new pid namespaces
2025-03-06 10:18:36 +01:00
pid_sysctl.h
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
pid.c
pidfs: detect refcount bugs
2025-05-06 13:59:00 +02:00
profile.c
profiling: remove profile=sleep support
2024-08-04 13:36:28 -07:00
ptrace.c
ptrace: introduce PTRACE_SET_SYSCALL_INFO request
2025-05-11 17:48:15 -07:00
range.c
…
reboot.c
Merge tag 'mm-nonmm-stable-2025-03-30-18-23' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-04-01 10:06:52 -07:00
regset.c
regset: use kvzalloc() for regset_get_alloc()
2024-04-25 21:07:03 -07:00
relay.c
relay: remove unused relay_late_setup_files
2025-05-11 17:54:09 -07:00
resource_kunit.c
resource, kunit: fix user-after-free in resource_test_region_intersects()
2024-10-09 12:47:19 -07:00
resource.c
resource: replace open coded variant of DEFINE_RES()
2025-03-21 22:10:05 -07:00
rseq.c
rseq: Fix segfault on registration when rseq_cs is non-zero
2025-03-06 22:26:49 +01:00
scftorture.c
scftorture: Handle NULL argument passed to scf_add_to_free_list().
2024-11-14 16:09:51 -08:00
scs.c
…
seccomp.c
seccomp: avoid the lock trip seccomp_filter_release in common case
2025-02-24 11:17:10 -08:00
signal.c
signal: Move signal ctl tables into signal.c
2025-04-09 13:32:16 +02:00
smp.c
Merge tag 'csd-lock.2025.01.28a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu
2025-01-28 11:34:03 -08:00
smpboot.c
…
smpboot.h
…
softirq.c
lockdep: Fix wait context check on softirq for PREEMPT_RT
2025-03-25 10:46:44 +01:00
stackleak.c
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
stacktrace.c
…
static_call_inline.c
Merge tag 'modules-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux
2025-03-30 15:44:36 -07:00
static_call.c
…
stop_machine.c
stop-machine: Add comment for rcu_momentary_eqs()
2025-03-11 10:15:52 -07:00
sys_ni.c
Merge tag 'probes-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
2024-07-18 12:19:20 -07:00
sys.c
futex: Add basic infrastructure for local task local hash
2025-05-03 12:02:07 +02:00
sysctl-test.c
sysctl: move u8 register test to lib/test_sysctl.c
2025-04-14 14:13:41 +02:00
sysctl.c
sparc: mv sparc sysctls into their own file under arch/sparc/kernel
2025-04-09 13:32:16 +02:00
task_work.c
kasan: make kasan_record_aux_stack_noalloc() the default behaviour
2025-01-13 22:40:36 -08:00
taskstats.c
fdget(), more trivial conversions
2024-11-03 01:28:06 -05:00
torture.c
torture: Add get_torture_init_jiffies() for test-start time
2025-02-05 07:14:24 -08:00
tracepoint.c
tracepoint: Print the function symbol when tracepoint_debug is set
2025-03-21 15:30:10 -04:00
tsacct.c
tsacct: replace strncpy() with strscpy()
2024-07-12 16:39:53 -07:00
ucount.c
ucount: use rcuref_t for reference counting
2025-03-16 22:30:50 -07:00
uid16.c
…
uid16.h
…
umh.c
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
up.c
…
user_namespace.c
uidgid: add map_id_range_up()
2025-02-12 12:12:27 +01:00
user-return-notifier.c
…
user.c
uidgid: make sure we fit into one cacheline
2024-09-12 12:16:09 +02:00
usermode_driver.c
…
utsname_sysctl.c
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
utsname.c
…
vhost_task.c
vhost_task: fix vhost_task_create() documentation
2025-04-18 10:08:11 -04:00
vmcore_info.c
crash: export PAGE_UNACCEPTED_MAPCOUNT_VALUE to vmcoreinfo
2025-05-11 17:54:04 -07:00
watch_queue.c
Merge tag 'vfs-6.15-rc1.pipe' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2025-03-24 09:52:37 -07:00
watchdog_buddy.c
…
watchdog_perf.c
Merge tag 'mm-nonmm-stable-2025-03-30-18-23' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2025-04-01 10:06:52 -07:00
watchdog.c
kernel/watchdog: add /sys/kernel/{hard,soft}lockup_count
2025-05-21 10:48:22 -07:00
workqueue_internal.h
…
workqueue.c
treewide, timers: Rename from_timer() to timer_container_of()
2025-06-08 09:07:37 +02:00