null_blk: fix use-after-free problem (21974061) · Commits · 戴 / test

end_cmd finishes request associated with nullb_cmd struct, so we should save pointer to request_queue in a local variable before calling end_cmd. The problem was causes general protection fault with slab poisoning enabled. Fixes: ("null_blk: restart request processing on completion handler") Tested-by:

Akinobu Mita <akinobu.mita@gmail.com> Signed-off-by:

Mike Krinkin <krinkin.m.u@gmail.com> Signed-off-by:

Jens Axboe <axboe@fb.com>

drivers/block/null_blk.c

+9 −9

Original line number	Diff line number	Diff line
		@@ -240,20 +240,20 @@ static enum hrtimer_restart null_cmd_timer_expired(struct hrtimer *timer)
		while ((entry = llist_del_all(&cq->list)) != NULL) {
		entry = llist_reverse_order(entry);
		do {
		struct request_queue *q = NULL;

		cmd = container_of(entry, struct nullb_cmd, ll_list);
		entry = entry->next;
		if (cmd->rq)
		q = cmd->rq->q;
		end_cmd(cmd);

		if (cmd->rq) {
		struct request_queue *q = cmd->rq->q;

		if (!q->mq_ops && blk_queue_stopped(q)) {
		if (q && !q->mq_ops && blk_queue_stopped(q)) {
		spin_lock(q->queue_lock);
		if (blk_queue_stopped(q))
		blk_start_queue(q);
		spin_unlock(q->queue_lock);
		}
		}
		} while (entry);
		}

Admin message