* [PATCH] null_blk: fix use-after-free error
@ 2015-12-15 9:56 Mike Krinkin
2015-12-22 2:11 ` Ming Lei
2015-12-22 17:43 ` Jens Axboe
0 siblings, 2 replies; 3+ messages in thread
From: Mike Krinkin @ 2015-12-15 9:56 UTC (permalink / raw)
To: axboe; +Cc: avanzini, paolo.valente, linux-kernel, Mike Krinkin
blk_end_request_all may free request, so we need to save
request_queue pointer before blk_end_request_all call.
The problem was introduced in commit cf8ecc5a8455266f8d51
("null_blk: guarantee device restart in all irq modes")
and causes general protection fault with slab poisoning
enabled.
Fixes: cf8ecc5a8455266f8d51 ("null_blk: guarantee device
restart in all irq modes")
Signed-off-by: Mike Krinkin <krinkin.m.u@gmail.com>
---
drivers/block/null_blk.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 36c4651..6a06e3e 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -219,6 +219,9 @@ static void end_cmd(struct nullb_cmd *cmd)
{
struct request_queue *q = NULL;
+ if (cmd->rq)
+ q = cmd->rq->q;
+
switch (queue_mode) {
case NULL_Q_MQ:
blk_mq_end_request(cmd->rq, 0);
@@ -232,9 +235,6 @@ static void end_cmd(struct nullb_cmd *cmd)
goto free_cmd;
}
- if (cmd->rq)
- q = cmd->rq->q;
-
/* Restart queue if needed, as we are freeing a tag */
if (q && !q->mq_ops && blk_queue_stopped(q)) {
unsigned long flags;
--
1.9.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] null_blk: fix use-after-free error
2015-12-15 9:56 [PATCH] null_blk: fix use-after-free error Mike Krinkin
@ 2015-12-22 2:11 ` Ming Lei
2015-12-22 17:43 ` Jens Axboe
1 sibling, 0 replies; 3+ messages in thread
From: Ming Lei @ 2015-12-22 2:11 UTC (permalink / raw)
To: Mike Krinkin
Cc: Jens Axboe, avanzini, paolo.valente, Linux Kernel Mailing List
On Tue, Dec 15, 2015 at 5:56 PM, Mike Krinkin <krinkin.m.u@gmail.com> wrote:
> blk_end_request_all may free request, so we need to save
> request_queue pointer before blk_end_request_all call.
>
> The problem was introduced in commit cf8ecc5a8455266f8d51
> ("null_blk: guarantee device restart in all irq modes")
> and causes general protection fault with slab poisoning
> enabled.
>
> Fixes: cf8ecc5a8455266f8d51 ("null_blk: guarantee device
> restart in all irq modes")
>
> Signed-off-by: Mike Krinkin <krinkin.m.u@gmail.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
> ---
> drivers/block/null_blk.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
> index 36c4651..6a06e3e 100644
> --- a/drivers/block/null_blk.c
> +++ b/drivers/block/null_blk.c
> @@ -219,6 +219,9 @@ static void end_cmd(struct nullb_cmd *cmd)
> {
> struct request_queue *q = NULL;
>
> + if (cmd->rq)
> + q = cmd->rq->q;
> +
> switch (queue_mode) {
> case NULL_Q_MQ:
> blk_mq_end_request(cmd->rq, 0);
> @@ -232,9 +235,6 @@ static void end_cmd(struct nullb_cmd *cmd)
> goto free_cmd;
> }
>
> - if (cmd->rq)
> - q = cmd->rq->q;
> -
> /* Restart queue if needed, as we are freeing a tag */
> if (q && !q->mq_ops && blk_queue_stopped(q)) {
> unsigned long flags;
> --
> 1.9.1
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
--
Ming Lei
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] null_blk: fix use-after-free error
2015-12-15 9:56 [PATCH] null_blk: fix use-after-free error Mike Krinkin
2015-12-22 2:11 ` Ming Lei
@ 2015-12-22 17:43 ` Jens Axboe
1 sibling, 0 replies; 3+ messages in thread
From: Jens Axboe @ 2015-12-22 17:43 UTC (permalink / raw)
To: Mike Krinkin; +Cc: avanzini, paolo.valente, linux-kernel
On 12/15/2015 02:56 AM, Mike Krinkin wrote:
> blk_end_request_all may free request, so we need to save
> request_queue pointer before blk_end_request_all call.
>
> The problem was introduced in commit cf8ecc5a8455266f8d51
> ("null_blk: guarantee device restart in all irq modes")
> and causes general protection fault with slab poisoning
> enabled.
>
> Fixes: cf8ecc5a8455266f8d51 ("null_blk: guarantee device
> restart in all irq modes")
Added for 4.4, thanks.
--
Jens Axboe
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-12-22 17:43 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-12-15 9:56 [PATCH] null_blk: fix use-after-free error Mike Krinkin
2015-12-22 2:11 ` Ming Lei
2015-12-22 17:43 ` Jens Axboe
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.