Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933354AbbLOJ4u (ORCPT ); Tue, 15 Dec 2015 04:56:50 -0500 Received: from mail-lf0-f42.google.com ([209.85.215.42]:36854 "EHLO mail-lf0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933212AbbLOJ4s (ORCPT ); Tue, 15 Dec 2015 04:56:48 -0500 From: Mike Krinkin To: axboe@fb.com Cc: avanzini@google.com, paolo.valente@unimore.it, linux-kernel@vger.kernel.org, Mike Krinkin Subject: [PATCH] null_blk: fix use-after-free error Date: Tue, 15 Dec 2015 12:56:40 +0300 Message-Id: <1450173400-18287-1-git-send-email-krinkin.m.u@gmail.com> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1410 Lines: 48 blk_end_request_all may free request, so we need to save request_queue pointer before blk_end_request_all call. The problem was introduced in commit cf8ecc5a8455266f8d51 ("null_blk: guarantee device restart in all irq modes") and causes general protection fault with slab poisoning enabled. Fixes: cf8ecc5a8455266f8d51 ("null_blk: guarantee device restart in all irq modes") Signed-off-by: Mike Krinkin --- drivers/block/null_blk.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c index 36c4651..6a06e3e 100644 --- a/drivers/block/null_blk.c +++ b/drivers/block/null_blk.c @@ -219,6 +219,9 @@ static void end_cmd(struct nullb_cmd *cmd) { struct request_queue *q = NULL; + if (cmd->rq) + q = cmd->rq->q; + switch (queue_mode) { case NULL_Q_MQ: blk_mq_end_request(cmd->rq, 0); @@ -232,9 +235,6 @@ static void end_cmd(struct nullb_cmd *cmd) goto free_cmd; } - if (cmd->rq) - q = cmd->rq->q; - /* Restart queue if needed, as we are freeing a tag */ if (q && !q->mq_ops && blk_queue_stopped(q)) { unsigned long flags; -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/