From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754195AbbJPR4l (ORCPT ); Fri, 16 Oct 2015 13:56:41 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:21852 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752345AbbJPR4k (ORCPT ); Fri, 16 Oct 2015 13:56:40 -0400 Message-ID: <56213A4F.6060008@oracle.com> Date: Fri, 16 Oct 2015 13:56:31 -0400 From: Sasha Levin User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: axboe@kernel.dk CC: keith.busch@intel.com, linux-kernel@vger.kernel.org Subject: Re: [PATCH] blk-mq: use after free when freeing tag sets References: <1443836435-24480-1-git-send-email-sasha.levin@oracle.com> In-Reply-To: <1443836435-24480-1-git-send-email-sasha.levin@oracle.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Source-IP: aserv0021.oracle.com [141.146.126.233] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org ping? On 10/02/2015 09:40 PM, Sasha Levin wrote: > Commit f26cdc853 ("blk-mq: Shared tag enhancements") has introduced a use after > free where it tried to free the cpumask var out of the tag set but the tag set > was already freed by blk_mq_free_rq_map(). > > Signed-off-by: Sasha Levin > --- > block/blk-mq-tag.c | 1 + > block/blk-mq.c | 7 ++----- > 2 files changed, 3 insertions(+), 5 deletions(-) > > diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c > index f6020c6..c03eeb8 100644 > --- a/block/blk-mq-tag.c > +++ b/block/blk-mq-tag.c > @@ -628,6 +628,7 @@ void blk_mq_free_tags(struct blk_mq_tags *tags) > { > bt_free(&tags->bitmap_tags); > bt_free(&tags->breserved_tags); > + free_cpumask_var(tags->cpumask); > kfree(tags); > } > > diff --git a/block/blk-mq.c b/block/blk-mq.c > index 5692c15..197a615 100644 > --- a/block/blk-mq.c > +++ b/block/blk-mq.c > @@ -2270,12 +2270,9 @@ void blk_mq_free_tag_set(struct blk_mq_tag_set *set) > { > int i; > > - for (i = 0; i < set->nr_hw_queues; i++) { > - if (set->tags[i]) { > + for (i = 0; i < set->nr_hw_queues; i++) > + if (set->tags[i]) > blk_mq_free_rq_map(set, set->tags[i], i); > - free_cpumask_var(set->tags[i]->cpumask); > - } > - } > > kfree(set->tags); > set->tags = NULL; >