From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751967AbbJNFFb (ORCPT ); Wed, 14 Oct 2015 01:05:31 -0400 Received: from TYO201.gate.nec.co.jp ([210.143.35.51]:64114 "EHLO tyo201.gate.nec.co.jp" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750817AbbJNFF2 convert rfc822-to-8bit (ORCPT ); Wed, 14 Oct 2015 01:05:28 -0400 From: Junichi Nomura To: Jens Axboe , "linux-kernel@vger.kernel.org" CC: Keith Busch , "axboe@fb.com" Subject: [PATCH] blk-mq: fix use-after-free in blk_mq_free_tag_set() Thread-Topic: [PATCH] blk-mq: fix use-after-free in blk_mq_free_tag_set() Thread-Index: AQHRBj1+VLoTBaEObky4++0RfDwquw== Date: Wed, 14 Oct 2015 05:02:15 +0000 Message-ID: <20151014050213.GA10302@xzibit.linux.bs1.fc.nec.co.jp> Accept-Language: ja-JP, en-US Content-Language: ja-JP X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.34.125.85] Content-Type: text/plain; charset="iso-2022-jp" Content-ID: Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org tags is freed in blk_mq_free_rq_map() and should not be used after that. The problem doesn't manifest if CONFIG_CPUMASK_OFFSTACK is false because free_cpumask_var() is nop. tags->cpumask is allocated in blk_mq_init_tags() so it's natural to free cpumask in its counter part, blk_mq_free_tags(). Fixes: f26cdc8536ad ("blk-mq: Shared tag enhancements") Signed-off-by: Jun'ichi Nomura Cc: Keith Busch Cc: Jens Axboe --- block/blk-mq-tag.c | 1 + block/blk-mq.c | 4 +--- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c index ed96474..ec2d119 100644 --- a/block/blk-mq-tag.c +++ b/block/blk-mq-tag.c @@ -641,6 +641,7 @@ void blk_mq_free_tags(struct blk_mq_tags *tags) { bt_free(&tags->bitmap_tags); bt_free(&tags->breserved_tags); + free_cpumask_var(tags->cpumask); kfree(tags); } diff --git a/block/blk-mq.c b/block/blk-mq.c index 7785ae9..85f0143 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2296,10 +2296,8 @@ void blk_mq_free_tag_set(struct blk_mq_tag_set *set) int i; for (i = 0; i < set->nr_hw_queues; i++) { - if (set->tags[i]) { + if (set->tags[i]) blk_mq_free_rq_map(set, set->tags[i], i); - free_cpumask_var(set->tags[i]->cpumask); - } } kfree(set->tags); -- 2.1.0