lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 2 Oct 2015 21:40:35 -0400 From: Sasha Levin <sasha.levin@...cle.com> To: axboe@...nel.dk Cc: keith.busch@...el.com, linux-kernel@...r.kernel.org, Sasha Levin <sasha.levin@...cle.com> Subject: [PATCH] blk-mq: use after free when freeing tag sets Commit f26cdc853 ("blk-mq: Shared tag enhancements") has introduced a use after free where it tried to free the cpumask var out of the tag set but the tag set was already freed by blk_mq_free_rq_map(). Signed-off-by: Sasha Levin <sasha.levin@...cle.com> --- block/blk-mq-tag.c | 1 + block/blk-mq.c | 7 ++----- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c index f6020c6..c03eeb8 100644 --- a/block/blk-mq-tag.c +++ b/block/blk-mq-tag.c @@ -628,6 +628,7 @@ void blk_mq_free_tags(struct blk_mq_tags *tags) { bt_free(&tags->bitmap_tags); bt_free(&tags->breserved_tags); + free_cpumask_var(tags->cpumask); kfree(tags); } diff --git a/block/blk-mq.c b/block/blk-mq.c index 5692c15..197a615 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2270,12 +2270,9 @@ void blk_mq_free_tag_set(struct blk_mq_tag_set *set) { int i; - for (i = 0; i < set->nr_hw_queues; i++) { - if (set->tags[i]) { + for (i = 0; i < set->nr_hw_queues; i++) + if (set->tags[i]) blk_mq_free_rq_map(set, set->tags[i], i); - free_cpumask_var(set->tags[i]->cpumask); - } - } kfree(set->tags); set->tags = NULL; -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists