From: Bart Van Assche <bvanassche@acm.org>
To: Wang Yingjie <x-professor@outlook.com>,
"James.Bottomley@HansenPartnership.com"
<James.Bottomley@HansenPartnership.com>,
"mkp@kernel.org" <mkp@kernel.org>
Cc: "yangxiuwei@kylinos.cn" <yangxiuwei@kylinos.cn>,
"axboe@kernel.dk" <axboe@kernel.dk>,
"linux-scsi@vger.kernel.org" <linux-scsi@vger.kernel.org>,
"io-uring@vger.kernel.org" <io-uring@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: Re: [PATCH 2/6] scsi: sr: release CDDA request before copying to userspace
Date: Mon, 19 Oct 2026 13:33:30 -0700 [thread overview]
Message-ID: <035f0183-a748-4eaa-a6a6-a358944535fa@acm.org> (raw)
In-Reply-To: <94d7bdf7391f208b74ba98988c2a52c939d689e6.1792237341.git.x-professor@outlook.com>
On 10/18/26 8:41 AM, Wang Yingjie wrote:
> diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
> index c36c54ecd354..de43d6e56479 100644
> --- a/drivers/scsi/sr.c
> +++ b/drivers/scsi/sr.c
> @@ -968,8 +968,11 @@ static int sr_read_cdda_bpc(struct cdrom_device_info *cdi, void __user *ubuf,
> ret = -EIO;
> }
>
> + blk_mq_free_request(rq);
> if (blk_rq_unmap_user(bio))
> ret = -EFAULT;
> + return ret;
> +
> out_put_request:
> blk_mq_free_request(rq);
> return ret;
This change triggers a use-after-free because blk_mq_free_request()
calls bio_put(), isn't it?
Bart.
next prev parent reply other threads:[~2026-10-19 20:33 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-18 15:41 [PATCH 0/6] scsi: make SG_IO user copyback failure-safe Wang Yingjie
2026-10-18 15:41 ` [PATCH 1/6] scsi: core: release SG_IO request before copying to userspace Wang Yingjie
2026-10-18 15:41 ` [PATCH 2/6] scsi: sr: release CDDA " Wang Yingjie
2026-10-19 20:33 ` Bart Van Assche [this message]
2026-10-18 15:41 ` [PATCH 3/6] scsi: bsg: release synchronous request before user copyback Wang Yingjie
2026-10-18 15:41 ` [PATCH 4/6] scsi: bsg: report synchronous data copyback failures Wang Yingjie
2026-10-18 15:41 ` [PATCH 5/6] scsi: bsg: release io_uring request before user copyback Wang Yingjie
2026-10-18 15:41 ` [PATCH 6/6] scsi: bsg: report io_uring data copyback failures Wang Yingjie
2026-10-18 16:41 ` [PATCH 0/6] scsi: make SG_IO user copyback failure-safe Bart Van Assche
2026-10-19 6:32 ` Wang Yingjie
2026-10-19 21:11 ` Bart Van Assche
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=035f0183-a748-4eaa-a6a6-a358944535fa@acm.org \
--to=bvanassche@acm.org \
--cc=James.Bottomley@HansenPartnership.com \
--cc=axboe@kernel.dk \
--cc=io-uring@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=mkp@kernel.org \
--cc=stable@vger.kernel.org \
--cc=x-professor@outlook.com \
--cc=yangxiuwei@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox