From: Tejun Heo <tj@kernel.org>
To: "Jun'ichi Nomura" <j-nomura@ce.jp.nec.com>
Cc: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Vivek Goyal <vgoyal@redhat.com>, Jens Axboe <axboe@kernel.dk>
Subject: Re: [PATCH] blkcg: Fix use-after-free of q->root_blkg and q->root_rl.blkg
Date: Thu, 18 Oct 2012 14:21:33 -0700 [thread overview]
Message-ID: <20121018212133.GL13370@google.com> (raw)
In-Reply-To: <507E7030.9070607@ce.jp.nec.com>
On Wed, Oct 17, 2012 at 05:45:36PM +0900, Jun'ichi Nomura wrote:
> blk_put_rl() does not call blkg_put() for q->root_rl because we
> don't take request list reference on q->root_blkg.
> However, if root_blkg is once attached then detached (freed),
> blk_put_rl() is confused by the bogus pointer in q->root_blkg.
>
> For example, with !CONFIG_BLK_DEV_THROTTLING &&
> CONFIG_CFQ_GROUP_IOSCHED,
> switching IO scheduler from cfq to deadline will cause system stall
> after the following warning with 3.6:
...
> This patch clears q->root_blkg and q->root_rl.blkg when root blkg
> is destroyed.
>
> Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
> Acked-by: Vivek Goyal <vgoyal@redhat.com>
> Cc: Tejun Heo <tj@kernel.org>
> Cc: Jens Axboe <axboe@kernel.dk>
Acked-by: Tejun Heo <tj@kernel.org>
Jens, this one needs Cc: stable.
Thanks.
--
tejun
next prev parent reply other threads:[~2012-10-18 21:21 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-10 5:11 [PATCH] Fix use-after-free of q->root_blkg and q->root_rl.blkg Jun'ichi Nomura
2012-10-10 15:59 ` Vivek Goyal
2012-10-11 1:31 ` Jun'ichi Nomura
2012-10-11 18:55 ` Vivek Goyal
2012-10-16 23:20 ` Tejun Heo
2012-10-17 0:02 ` Jun'ichi Nomura
2012-10-17 8:45 ` [PATCH] blkcg: " Jun'ichi Nomura
2012-10-18 21:21 ` Tejun Heo [this message]
2012-10-22 18:43 ` Jens Axboe
2012-10-17 13:47 ` [PATCH] " Vivek Goyal
2012-10-18 2:56 ` Jun'ichi Nomura
2012-10-18 13:31 ` Vivek Goyal
2012-10-18 21:20 ` Tejun Heo
2012-10-19 14:53 ` Vivek Goyal
2012-10-22 0:55 ` Jun'ichi Nomura
2012-10-22 1:15 ` [PATCH] blkcg: stop iteration early if root_rl is the only request list Jun'ichi Nomura
2012-10-22 15:31 ` Vivek Goyal
2012-10-22 18:43 ` Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121018212133.GL13370@google.com \
--to=tj@kernel.org \
--cc=axboe@kernel.dk \
--cc=j-nomura@ce.jp.nec.com \
--cc=linux-kernel@vger.kernel.org \
--cc=vgoyal@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.