From: Al Viro <viro@zeniv.linux.org.uk>
To: linux-block@vger.kernel.org
Subject: UAF in blk_add_rq_to_plug()?
Date: Mon, 31 Oct 2022 22:12:57 +0000 [thread overview]
Message-ID: <Y2BIad98er4QsbZY@ZenIV> (raw)
static void blk_add_rq_to_plug(struct blk_plug *plug, struct request *rq)
{
struct request *last = rq_list_peek(&plug->mq_list);
Suppose it's not NULL...
if (!plug->rq_count) {
trace_block_plug(rq->q);
} else if (plug->rq_count >= blk_plug_max_rq_count(plug) ||
(!blk_queue_nomerges(rq->q) &&
blk_rq_bytes(last) >= BLK_PLUG_FLUSH_SIZE)) {
... and we went here:
blk_mq_flush_plug_list(plug, false);
All requests, including the one last points to, might get fed ->queue_rq()
here. At which point there seems to be nothing to prevent them getting
completed and freed on another CPU, possibly before we return here.
trace_block_plug(rq->q);
}
if (!plug->multiple_queues && last && last->q != rq->q)
... and here we dereference last.
Shouldn't we reset last to NULL after the call of blk_mq_flush_plug_list()
above?
next reply other threads:[~2022-10-31 22:13 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-31 22:12 Al Viro [this message]
2022-10-31 22:42 ` UAF in blk_add_rq_to_plug()? Jens Axboe
2022-10-31 23:35 ` Al Viro
2022-11-01 0:03 ` Jens Axboe
2022-11-01 0:06 ` Jens Axboe
2022-11-01 0:54 ` Al Viro
2022-11-01 2:23 ` Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y2BIad98er4QsbZY@ZenIV \
--to=viro@zeniv.linux.org.uk \
--cc=linux-block@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox