linux-kernel - Re: [PATCH] null_blk: fix use-after-free error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACVXFVPo2DqkkHxbbxGuOEQ_+3RoraVzAfdNdcW6-6PQMj3NVQ@mail.gmail.com>
Date:	Tue, 22 Dec 2015 10:11:24 +0800
From:	Ming Lei <tom.leiming@...il.com>
To:	Mike Krinkin <krinkin.m.u@...il.com>
Cc:	Jens Axboe <axboe@...com>, avanzini@...gle.com,
	paolo.valente@...more.it,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] null_blk: fix use-after-free error

On Tue, Dec 15, 2015 at 5:56 PM, Mike Krinkin <krinkin.m.u@...il.com> wrote:
> blk_end_request_all may free request, so we need to save
> request_queue pointer before blk_end_request_all call.
>
> The problem was introduced in commit cf8ecc5a8455266f8d51
> ("null_blk: guarantee device restart in all irq modes")
> and causes general protection fault with slab poisoning
> enabled.
>
> Fixes: cf8ecc5a8455266f8d51 ("null_blk: guarantee device
>        restart in all irq modes")
>
> Signed-off-by: Mike Krinkin <krinkin.m.u@...il.com>

Reviewed-by: Ming Lei <tom.leiming@...il.com>

> ---
>  drivers/block/null_blk.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
> index 36c4651..6a06e3e 100644
> --- a/drivers/block/null_blk.c
> +++ b/drivers/block/null_blk.c
> @@ -219,6 +219,9 @@ static void end_cmd(struct nullb_cmd *cmd)
>  {
>         struct request_queue *q = NULL;
>
> +       if (cmd->rq)
> +               q = cmd->rq->q;
> +
>         switch (queue_mode)  {
>         case NULL_Q_MQ:
>                 blk_mq_end_request(cmd->rq, 0);
> @@ -232,9 +235,6 @@ static void end_cmd(struct nullb_cmd *cmd)
>                 goto free_cmd;
>         }
>
> -       if (cmd->rq)
> -               q = cmd->rq->q;
> -
>         /* Restart queue if needed, as we are freeing a tag */
>         if (q && !q->mq_ops && blk_queue_stopped(q)) {
>                 unsigned long flags;
> --
> 1.9.1
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/



-- 
Ming Lei
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/