linux-kernel - [PATCH] block: mq-deadline: check if elevator is attached to queue in dd_finish

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250617205630.207696-1-git@elijahs.space>
Date: Tue, 17 Jun 2025 13:56:08 -0700
From: Elijah Wright <git@...jahs.space>
To: Jens Axboe <axboe@...nel.dk>,
	linux-block@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: Elijah Wright <git@...jahs.space>
Subject: [PATCH] block: mq-deadline: check if elevator is attached to queue in dd_finish_request

in dd_finish_request(), per_prio points to a rq->elv.priv[0], which could be
free memory if an in-flight requests completes after its associated scheduler
has been freed

Signed-off-by: Elijah Wright <git@...jahs.space>
---
 block/mq-deadline.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index 2edf1cac06d5..4d7b21b144d3 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -751,13 +751,15 @@ static void dd_finish_request(struct request *rq)
 {
 	struct dd_per_prio *per_prio = rq->elv.priv[0];
 
-	/*
-	 * The block layer core may call dd_finish_request() without having
-	 * called dd_insert_requests(). Skip requests that bypassed I/O
-	 * scheduling. See also blk_mq_request_bypass_insert().
-	 */
-	if (per_prio)
-		atomic_inc(&per_prio->stats.completed);
+	if (rq->q->elevator) {
+		/*
+		* The block layer core may call dd_finish_request() without having
+		* called dd_insert_requests(). Skip requests that bypassed I/O
+		* scheduling. See also blk_mq_request_bypass_insert().
+		*/
+		if (per_prio)
+			atomic_inc(&per_prio->stats.completed);
+	}
 }
 
 static bool dd_has_work_for_prio(struct dd_per_prio *per_prio)
-- 
2.43.0