[PATCH] ublk: fix use-after-free in ublk_partition_scan_work

[PATCH] ublk: fix use-after-free in ublk_partition_scan_work

[Ming Lei]

A race condition exists between the async partition scan work and device
teardown that can lead to a use-after-free of ub->ub_disk:

1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk()
2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does:
   - del_gendisk(ub->ub_disk)
   - ublk_detach_disk() sets ub->ub_disk = NULL
   - put_disk() which may free the disk
3. The worker ublk_partition_scan_work() then dereferences ub->ub_disk
   leading to UAF

Fix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold
a reference to the disk during the partition scan. The spinlock in
ublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker
either gets a valid reference or sees NULL and exits early.

Also change flush_work() to cancel_work_sync() to avoid running the
partition scan work unnecessarily when the disk is already detached.

Fixes: 7fc4da6a304b ("ublk: scan partition in async way")
Reported-by: Ruikai Peng <ruikai@pwno.io>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
---
 drivers/block/ublk_drv.c | 37 ++++++++++++++++++++++---------------
 1 file changed, 22 insertions(+), 15 deletions(-)

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 837fedb02e0d..f6e5a0766721 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -255,20 +255,6 @@ static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub,
 		u16 q_id, u16 tag, struct ublk_io *io, size_t offset);
 static inline unsigned int ublk_req_build_flags(struct request *req);
 
-static void ublk_partition_scan_work(struct work_struct *work)
-{
-	struct ublk_device *ub =
-		container_of(work, struct ublk_device, partition_scan_work);
-
-	if (WARN_ON_ONCE(!test_and_clear_bit(GD_SUPPRESS_PART_SCAN,
-					     &ub->ub_disk->state)))
-		return;
-
-	mutex_lock(&ub->ub_disk->open_mutex);
-	bdev_disk_changed(ub->ub_disk, false);
-	mutex_unlock(&ub->ub_disk->open_mutex);
-}
-
 static inline struct ublksrv_io_desc *
 ublk_get_iod(const struct ublk_queue *ubq, unsigned tag)
 {
@@ -1597,6 +1583,27 @@ static void ublk_put_disk(struct gendisk *disk)
 		put_device(disk_to_dev(disk));
 }
 
+static void ublk_partition_scan_work(struct work_struct *work)
+{
+	struct ublk_device *ub =
+		container_of(work, struct ublk_device, partition_scan_work);
+	/* Hold disk reference to prevent UAF during concurrent teardown */
+	struct gendisk *disk = ublk_get_disk(ub);
+
+	if (!disk)
+		return;
+
+	if (WARN_ON_ONCE(!test_and_clear_bit(GD_SUPPRESS_PART_SCAN,
+					     &disk->state)))
+		goto out;
+
+	mutex_lock(&disk->open_mutex);
+	bdev_disk_changed(disk, false);
+	mutex_unlock(&disk->open_mutex);
+out:
+	ublk_put_disk(disk);
+}
+
 /*
  * Use this function to ensure that ->canceling is consistently set for
  * the device and all queues. Do not set these flags directly.
@@ -2041,7 +2048,7 @@ static void ublk_stop_dev(struct ublk_device *ub)
 	mutex_lock(&ub->mutex);
 	ublk_stop_dev_unlocked(ub);
 	mutex_unlock(&ub->mutex);
-	flush_work(&ub->partition_scan_work);
+	cancel_work_sync(&ub->partition_scan_work);
 	ublk_cancel_dev(ub);
 }
 
-- 
2.47.1

Re: [PATCH] ublk: fix use-after-free in ublk_partition_scan_work

[Jens Axboe]

On Fri, 09 Jan 2026 20:14:54 +0800, Ming Lei wrote:
> A race condition exists between the async partition scan work and device
> teardown that can lead to a use-after-free of ub->ub_disk:
> 
> 1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk()
> 2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does:
>    - del_gendisk(ub->ub_disk)
>    - ublk_detach_disk() sets ub->ub_disk = NULL
>    - put_disk() which may free the disk
> 3. The worker ublk_partition_scan_work() then dereferences ub->ub_disk
>    leading to UAF
> 
> [...]

Applied, thanks!

[1/1] ublk: fix use-after-free in ublk_partition_scan_work
      commit: f0d385f6689f37a2828c686fb279121df006b4cb

Best regards,
-- 
Jens Axboe

Re: [PATCH] ublk: fix use-after-free in ublk_partition_scan_work

[Christoph Hellwig]

Why does ublk have it's own partition scan code anyway?

Re: [PATCH] ublk: fix use-after-free in ublk_partition_scan_work

[Ming Lei]

On Fri, Jan 09, 2026 at 07:09:44AM -0800, Christoph Hellwig wrote:
> Why does ublk have it's own partition scan code anyway?

It is for improving error handling and avoiding deadlock.

ub->mutex is held when calling add_disk(), when IO error or timeout is
triggered, error handling code path requires ub->mutex.

So it takes nvme mpath's approach to scan partition from wq context.

Thanks, 
Ming

Re: [PATCH] ublk: fix use-after-free in ublk_partition_scan_work

[Christoph Hellwig]

On Fri, Jan 09, 2026 at 11:31:15PM +0800, Ming Lei wrote:
> On Fri, Jan 09, 2026 at 07:09:44AM -0800, Christoph Hellwig wrote:
> > Why does ublk have it's own partition scan code anyway?
> 
> It is for improving error handling and avoiding deadlock.
> 
> ub->mutex is held when calling add_disk(), when IO error or timeout is
> triggered, error handling code path requires ub->mutex.
> 
> So it takes nvme mpath's approach to scan partition from wq context.

Ok.  I have to say I hate both instance of it, we really need to find
a way to do better than that :(