Re: [REPORT] BUG: KASAN: use-after-free in bt_iter+0x80/0xf8

[Ming Lei <ming.lei@redhat.com>]

On Wed, Aug 19, 2020 at 08:43:46AM +0100, John Garry wrote:
> On 19/08/2020 01:00, Ming Lei wrote:
> > On Tue, Aug 18, 2020 at 07:19:57PM +0100, John Garry wrote:
> > > On 18/08/2020 13:03, John Garry wrote:
> > > > Hi guys,
> > > > 
> > > > JFYI, While doing some testing on v5.9-rc1, I stumbled across this:
> > > 
> > > I bisected to here (hopefully without mistake):
> > 
> > This one is a long-term problem, see the following discussion:
> > 
> > https://lore.kernel.org/linux-block/1553492318-1810-1-git-send-email-jianchao.w.wang@oracle.com/
> > 
> > 
> 
> ah, right. I vaguely remember this. Well, if we didn't have a reliable
> reproducer before, we do now.

OK, that is great, please try the following patch:

diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 32d82e23b095..f18632c524e9 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -185,19 +185,19 @@ static bool bt_iter(struct sbitmap *bitmap, unsigned int bitnr, void *data)
 {
 	struct bt_iter_data *iter_data = data;
 	struct blk_mq_hw_ctx *hctx = iter_data->hctx;
-	struct blk_mq_tags *tags = hctx->tags;
+	struct blk_mq_tags *tags = hctx->sched_tags ?: hctx->tags;
 	bool reserved = iter_data->reserved;
 	struct request *rq;
 
 	if (!reserved)
 		bitnr += tags->nr_reserved_tags;
-	rq = tags->rqs[bitnr];
+	rq = tags->static_rqs[bitnr];
 
 	/*
 	 * We can hit rq == NULL here, because the tagging functions
 	 * test and set the bit before assigning ->rqs[].
 	 */
-	if (rq && rq->q == hctx->queue)
+	if (rq && rq->tag >= 0 && rq->q == hctx->queue)
 		return iter_data->fn(hctx, rq, iter_data->data, reserved);
 	return true;
 }
@@ -406,7 +406,7 @@ void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_iter_fn *fn,
 		return;
 
 	queue_for_each_hw_ctx(q, hctx, i) {
-		struct blk_mq_tags *tags = hctx->tags;
+		struct blk_mq_tags *tags = hctx->sched_tags ?: hctx->tags;
 
 		/*
 		 * If no software queues are currently mapped to this

-- 
Ming