From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751707AbbJCBkv (ORCPT ); Fri, 2 Oct 2015 21:40:51 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:25786 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751479AbbJCBku (ORCPT ); Fri, 2 Oct 2015 21:40:50 -0400 From: Sasha Levin To: axboe@kernel.dk Cc: keith.busch@intel.com, linux-kernel@vger.kernel.org, Sasha Levin Subject: [PATCH] blk-mq: use after free when freeing tag sets Date: Fri, 2 Oct 2015 21:40:35 -0400 Message-Id: <1443836435-24480-1-git-send-email-sasha.levin@oracle.com> X-Mailer: git-send-email 2.1.4 X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit f26cdc853 ("blk-mq: Shared tag enhancements") has introduced a use after free where it tried to free the cpumask var out of the tag set but the tag set was already freed by blk_mq_free_rq_map(). Signed-off-by: Sasha Levin --- block/blk-mq-tag.c | 1 + block/blk-mq.c | 7 ++----- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c index f6020c6..c03eeb8 100644 --- a/block/blk-mq-tag.c +++ b/block/blk-mq-tag.c @@ -628,6 +628,7 @@ void blk_mq_free_tags(struct blk_mq_tags *tags) { bt_free(&tags->bitmap_tags); bt_free(&tags->breserved_tags); + free_cpumask_var(tags->cpumask); kfree(tags); } diff --git a/block/blk-mq.c b/block/blk-mq.c index 5692c15..197a615 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2270,12 +2270,9 @@ void blk_mq_free_tag_set(struct blk_mq_tag_set *set) { int i; - for (i = 0; i < set->nr_hw_queues; i++) { - if (set->tags[i]) { + for (i = 0; i < set->nr_hw_queues; i++) + if (set->tags[i]) blk_mq_free_rq_map(set, set->tags[i], i); - free_cpumask_var(set->tags[i]->cpumask); - } - } kfree(set->tags); set->tags = NULL; -- 1.7.10.4