mainline inclusion from mainline-v7.3-rc1 commit 285908f554fe32d9ca7cb7c3a03a05144faeb461 category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9153 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- nbd_add_socket() kreallocs config->socks, which a concurrent reader in nbd_handle_cmd() could UAF; commit b98e762e3d71 ("nbd: freeze the queue while we're adding connections")froze the queue to block that. But the freeze costs an RCU grace period on every socket added, and setup adds them one by one. After the previous patch, nbd_add_socket() is rejected once nbd->pid is set, so it only runs during setup. There the capacity is 0 and the write cache is off (cleared on disconnect by the preceding patch, and re-enabled only later in nbd_set_size), so submit_bio_noacct() rejects every bio before it reaches the driver -- non-zero-sector ones via bio_check_eod(), and flush-only ones via the !bdev_write_cache() branch. No I/O is in flight, so the freeze is unnecessary. Reviewed-by: Yu Kuai <yukuai@fygo.io> Signed-off-by: Yang Erkun <yangerkun@huawei.com> Link: https://patch.msgid.link/20260805122930.57647-5-yangerkun@huawei.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Conflicts: drivers/block/nbd.c [6.6 still uses the one-argument blk_mq_freeze_queue()/ blk_mq_unfreeze_queue() without the memflags return value, so drop the memflags declaration and the two unfreeze calls accordingly.] Signed-off-by: Yang Erkun <yangerkun@huawei.com> --- drivers/block/nbd.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index d045ec6ed661..8f2032e533de 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1173,12 +1173,6 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, if (!sock) return err; - /* - * We need to make sure we don't get any errant requests while we're - * reallocating the ->socks array. - */ - blk_mq_freeze_queue(nbd->disk->queue); - if (!netlink && !nbd->task_setup && !test_bit(NBD_RT_BOUND, &config->runtime_flags)) nbd->task_setup = current; @@ -1217,12 +1211,10 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, nsock->cookie = 0; socks[config->num_connections++] = nsock; atomic_inc(&config->live_connections); - blk_mq_unfreeze_queue(nbd->disk->queue); return 0; put_socket: - blk_mq_unfreeze_queue(nbd->disk->queue); sockfd_put(sock); return err; } -- 2.52.0