[PATCH 6.6.y 0/2] backport to fix a race condition/UAF in padata_reorder

[Bin Lan]

This series backports the fix for a use-after-free vulnerability in the 
padata subsystem, to the Linux 6.6.y stable branch.

Backport notes for 6.6.y:
  - The upstream fix (commit 71203f68c774) was written against mainline
    which uses the 2-argument cpumask_next_wrap(cpu, mask) API introduced
    by dc5bb9b769c9 ("cpumask: deprecate cpumask_next_wrap()"). Since
    6.6.y still has the original 4-argument API, the call in
    padata_reorder() is adapted to:
      cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false)
    This is functionally equivalent.

  - The context in padata_find_next() differs from mainline due to
    f954a2d37637 ("padata: switch padata_find_next() to using
    cpumask_next_wrap()") not being present in 6.6.y. The conflict was
    resolved.

After applying this series to v6.6.y, kernel/padata.c matches the upstream file at
commit 71203f68c774 with the following expected differences:

  1. cpumask_next_wrap() uses the 4-arg form (API not renamed in 6.6.y)
  2. padata_do_multithreaded() in 6.6.y lacks NUMA-aware dispatch (not backported)
  3. padata_do_multithreaded() in 6.6.y has an extra divide-by-zero guard for
     chunk_size

Thanks
Bin Lan

Herbert Xu (2):
  padata: Fix pd UAF once and for all
  padata: Remove comment for reorder_work

 include/linux/padata.h |   4 --
 kernel/padata.c        | 136 +++++++++++------------------------------
 2 files changed, 37 insertions(+), 103 deletions(-)

-- 
2.43.0