Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752274AbbLVCLa (ORCPT ); Mon, 21 Dec 2015 21:11:30 -0500 Received: from mail-ig0-f170.google.com ([209.85.213.170]:34224 "EHLO mail-ig0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751982AbbLVCLY (ORCPT ); Mon, 21 Dec 2015 21:11:24 -0500 MIME-Version: 1.0 In-Reply-To: <1450173400-18287-1-git-send-email-krinkin.m.u@gmail.com> References: <1450173400-18287-1-git-send-email-krinkin.m.u@gmail.com> Date: Tue, 22 Dec 2015 10:11:24 +0800 Message-ID: Subject: Re: [PATCH] null_blk: fix use-after-free error From: Ming Lei To: Mike Krinkin Cc: Jens Axboe , avanzini@google.com, paolo.valente@unimore.it, Linux Kernel Mailing List Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1995 Lines: 62 On Tue, Dec 15, 2015 at 5:56 PM, Mike Krinkin wrote: > blk_end_request_all may free request, so we need to save > request_queue pointer before blk_end_request_all call. > > The problem was introduced in commit cf8ecc5a8455266f8d51 > ("null_blk: guarantee device restart in all irq modes") > and causes general protection fault with slab poisoning > enabled. > > Fixes: cf8ecc5a8455266f8d51 ("null_blk: guarantee device > restart in all irq modes") > > Signed-off-by: Mike Krinkin Reviewed-by: Ming Lei > --- > drivers/block/null_blk.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c > index 36c4651..6a06e3e 100644 > --- a/drivers/block/null_blk.c > +++ b/drivers/block/null_blk.c > @@ -219,6 +219,9 @@ static void end_cmd(struct nullb_cmd *cmd) > { > struct request_queue *q = NULL; > > + if (cmd->rq) > + q = cmd->rq->q; > + > switch (queue_mode) { > case NULL_Q_MQ: > blk_mq_end_request(cmd->rq, 0); > @@ -232,9 +235,6 @@ static void end_cmd(struct nullb_cmd *cmd) > goto free_cmd; > } > > - if (cmd->rq) > - q = cmd->rq->q; > - > /* Restart queue if needed, as we are freeing a tag */ > if (q && !q->mq_ops && blk_queue_stopped(q)) { > unsigned long flags; > -- > 1.9.1 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ -- Ming Lei -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/