Commit e8271201 authored Dec 15, 2015 by Mike Krinkin Committed by Jens Axboe Dec 22, 2015

null_blk: fix use-after-free error



blk_end_request_all may free request, so we need to save
request_queue pointer before blk_end_request_all call.

The problem was introduced in commit cf8ecc5a
("null_blk: guarantee device restart in all irq modes")
and causes general protection fault with slab poisoning
enabled.

Fixes: cf8ecc5a ("null_blk: guarantee device
       restart in all irq modes")

Signed-off-by: Mike Krinkin <krinkin.m.u@gmail.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: Jens Axboe <axboe@fb.com>

parent 23688bf4

drivers/block/null_blk.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -219,6 +219,9 @@ static void end_cmd(struct nullb_cmd *cmd)
		{
		struct request_queue *q = NULL;

		if (cmd->rq)
		q = cmd->rq->q;

		switch (queue_mode) {
		case NULL_Q_MQ:
		blk_mq_end_request(cmd->rq, 0);
		@@ -232,9 +235,6 @@ static void end_cmd(struct nullb_cmd *cmd)
		goto free_cmd;
		}

		if (cmd->rq)
		q = cmd->rq->q;

		/* Restart queue if needed, as we are freeing a tag */
		if (q && !q->mq_ops && blk_queue_stopped(q)) {
		unsigned long flags;

Admin message