High · published February 26, 2025
In the Linux kernel, the following vulnerability has been resolved:
Revert "Revert "block, bfq: honor already-setup queue merges""
A crash [1] happened to be triggered in conjunction with commit
2d52c58b9c9b ("block, bfq: honor already-setup queue merges"). The
latter was then reverted by commit ebc69e897e17 ("Revert "block, bfq:
honor already-setup queue merges""). Yet, the reverted commit was not
the one introducing the bug. In fact, it actually triggered a UAF
introduced by a different commit, and now fixed by commit d29bd41428cf
("block, bfq: reset last_bfqq_created on group change").
So, there is no point in keeping commit 2d52c58b9c9b ("block, bfq:
honor already-setup queue merges") out. This commit restores it.
[1] https://bugzilla.kernel.org/show_bug.cgi?id=214503
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | < 4.19.238 | 4.19.238 |
| linux/linux_kernel | ≥ 4.20, < 5.4.189 | 5.4.189 |
| linux/linux_kernel | ≥ 5.5, < 5.10.110 | 5.10.110 |
| linux/linux_kernel | ≥ 5.11, < 5.15.33 | 5.15.33 |
| linux/linux_kernel | ≥ 5.16, < 5.16.19 | 5.16.19 |
| linux/linux_kernel | ≥ 5.17, < 5.17.2 | 5.17.2 |