[PATCH] null_blk: fix use-after-free problem

[PATCH] null_blk: fix use-after-free problem

[Mike Krinkin]

end_cmd finishes request associated with nullb_cmd struct, so we
should save pointer to request_queue in a local variable before
calling end_cmd.

The problem was causes general protection fault with slab poisoning
enabled.

Fixes: 8b70f45e2eb2 ("null_blk: restart request processing on
       completion handler")
Tested-by: Akinobu Mita <akinobu.mita@gmail.com>

Signed-off-by: Mike Krinkin <krinkin.m.u@gmail.com>
---
 drivers/block/null_blk.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 69de41a..3177b24 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -240,19 +240,19 @@ static enum hrtimer_restart null_cmd_timer_expired(struct hrtimer *timer)
 	while ((entry = llist_del_all(&cq->list)) != NULL) {
 		entry = llist_reverse_order(entry);
 		do {
+			struct request_queue *q = NULL;
+
 			cmd = container_of(entry, struct nullb_cmd, ll_list);
 			entry = entry->next;
+			if (cmd->rq)
+				q = cmd->rq->q;
 			end_cmd(cmd);
 
-			if (cmd->rq) {
-				struct request_queue *q = cmd->rq->q;
-
-				if (!q->mq_ops && blk_queue_stopped(q)) {
-					spin_lock(q->queue_lock);
-					if (blk_queue_stopped(q))
-						blk_start_queue(q);
-					spin_unlock(q->queue_lock);
-				}
+			if (q && !q->mq_ops && blk_queue_stopped(q)) {
+				spin_lock(q->queue_lock);
+				if (blk_queue_stopped(q))
+					blk_start_queue(q);
+				spin_unlock(q->queue_lock);
 			}
 		} while (entry);
 	}
-- 
1.9.1

Re: [PATCH] null_blk: fix use-after-free problem

[Jens Axboe]

On 07/19/2015 12:53 AM, Mike Krinkin wrote:
> end_cmd finishes request associated with nullb_cmd struct, so we
> should save pointer to request_queue in a local variable before
> calling end_cmd.
>
> The problem was causes general protection fault with slab poisoning
> enabled.

Thanks, applied.

-- 
Jens Axboe