From: Guixin Liu <kanie@linux.alibaba.com> mainline inclusion from mainline-v6.14-rc1 commit 1e95c798d8a7f70965f0f88d4657b682ff0ec75f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5X CVE: CVE-2024-54458 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... ------------------------------------------- Currently, this does not cause any issues, but I believe it is necessary to set bsg_queue to NULL after removing it to prevent potential use-after-free (UAF) access. Signed-off-by: Guixin Liu <kanie@linux.alibaba.com> Link: https://lore.kernel.org/r/20241218014214.64533-3-kanie@linux.alibaba.com Reviewed-by: Avri Altman <avri.altman@wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Conflicts: drivers/scsi/ufs/ufs_bsg.c drivers/ufs/core/ufs_bsg.c [Conflicts due to usf_bsg.c hasn't been moved to drivers/ufs/core.] Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com> --- drivers/scsi/ufs/ufs_bsg.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/ufs/ufs_bsg.c b/drivers/scsi/ufs/ufs_bsg.c index 5b2bc1a6f922..19111f864e23 100644 --- a/drivers/scsi/ufs/ufs_bsg.c +++ b/drivers/scsi/ufs/ufs_bsg.c @@ -175,6 +175,7 @@ void ufs_bsg_remove(struct ufs_hba *hba) return; bsg_remove_queue(hba->bsg_queue); + hba->bsg_queue = NULL; device_del(bsg_dev); put_device(bsg_dev); -- 2.43.0