Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Sergei Shtepa <sergei.shtepa@veeam.com>
To:     Jens Axboe <axboe@kernel.dk>, <linux-block@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>
CC:     <sergei.shtepa@veeam.com>, <pavel.tide@veeam.com>
Subject: [PATCH 1/1] block: fix potential infinite loop in the negative branch in __submit_bio_noacct_mq()
Date:   Tue, 23 Mar 2021 14:48:36 +0300
Message-ID: <1616500116-3411-2-git-send-email-sergei.shtepa@veeam.com>
In-Reply-To: <1616500116-3411-1-git-send-email-sergei.shtepa@veeam.com>
References: <1616500116-3411-1-git-send-email-sergei.shtepa@veeam.com>
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

When the blk_crypto_bio_prep() function returns false, the processing
of the bio request must end. Repeated access to blk_crypto_bio_prep()
for this same bio may lead to access to already released data, since in
this case the bio_endio() function was already called for bio.

The changes allow to leave the processing of the failed bio and
go to the next one from the bio_list.

The error can only occur when using inline encryption on
request-based blk-mq devices and something went wrong in the
__blk_crypto_bio_prep().

Signed-off-by: Sergei Shtepa <sergei.shtepa@veeam.com>
---
 block/blk-core.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/block/blk-core.c b/block/blk-core.c
index fc60ff208497..825df223b01d 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1005,13 +1005,12 @@ static blk_qc_t __submit_bio_noacct_mq(struct bio *bio)
 		if (unlikely(bio_queue_enter(bio) != 0))
 			continue;
 
-		if (!blk_crypto_bio_prep(&bio)) {
+		if (blk_crypto_bio_prep(&bio))
+			ret = blk_mq_submit_bio(bio);
+		else {
 			blk_queue_exit(disk->queue);
 			ret = BLK_QC_T_NONE;
-			continue;
 		}
-
-		ret = blk_mq_submit_bio(bio);
 	} while ((bio = bio_list_pop(&bio_list[0])));
 
 	current->bio_list = NULL;
-- 
2.20.1