Commit 013ee5a6 authored by Jens Axboe's avatar Jens Axboe
Browse files

Merge tag 'md-6.9-20240408' of... 

Merge tag 'md-6.9-20240408' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.9

Pull MD fix from Song:

"This change, by Yu Kuai, fixes a UAF in a corner case."

* tag 'md-6.9-20240408' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md:
  raid1: fix use-after-free for original bio in raid1_write_request()
parents b561ea56 fcf3f7e2

drivers/md/raid1.c

+1 −1
Original line number Diff line number Diff line
@@ -1558,7 +1558,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, 
		for (j = 0; j < i; j++)

			if (r1_bio->bios[j])

				rdev_dec_pending(conf->mirrors[j].rdev, mddev);

		free_r1bio(r1_bio);

		mempool_free(r1_bio, &conf->r1bio_pool);

		allow_barrier(conf, bio->bi_iter.bi_sector);



		if (bio->bi_opf & REQ_NOWAIT) {