From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754104AbbJPSAm (ORCPT ); Fri, 16 Oct 2015 14:00:42 -0400 Received: from mga11.intel.com ([192.55.52.93]:65043 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751401AbbJPSAk convert rfc822-to-8bit (ORCPT ); Fri, 16 Oct 2015 14:00:40 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.17,689,1437462000"; d="scan'208";a="828713900" From: "Busch, Keith" To: Sasha Levin , "axboe@kernel.dk" CC: "linux-kernel@vger.kernel.org" Subject: RE: [PATCH] blk-mq: use after free when freeing tag sets Thread-Topic: [PATCH] blk-mq: use after free when freeing tag sets Thread-Index: AQHQ/XyIQ1fwEw0r8kq4Fj5ILdQmHp5u8lmA//+K/gA= Date: Fri, 16 Oct 2015 18:00:33 +0000 Message-ID: References: <1443836435-24480-1-git-send-email-sasha.levin@oracle.com> <56213A4F.6060008@oracle.com> In-Reply-To: <56213A4F.6060008@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.1.200.106] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Oh, the same fix was applied from another developer: https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git/commit/?h=for-linus&id=f42d79ab67322e51b92dd7aa965e310c71352a64 Yours came first, though I just missed it. > On 10/02/2015 09:40 PM, Sasha Levin wrote: > > Commit f26cdc853 ("blk-mq: Shared tag enhancements") has introduced a use after > > free where it tried to free the cpumask var out of the tag set but the tag set > > was already freed by blk_mq_free_rq_map(). > > > > Signed-off-by: Sasha Levin > > --- > > block/blk-mq-tag.c | 1 + > > block/blk-mq.c | 7 ++----- > > 2 files changed, 3 insertions(+), 5 deletions(-) > > > > diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c > > index f6020c6..c03eeb8 100644 > > --- a/block/blk-mq-tag.c > > +++ b/block/blk-mq-tag.c > > @@ -628,6 +628,7 @@ void blk_mq_free_tags(struct blk_mq_tags *tags) > > { > > bt_free(&tags->bitmap_tags); > > bt_free(&tags->breserved_tags); > > + free_cpumask_var(tags->cpumask); > > kfree(tags); > > } > > > > diff --git a/block/blk-mq.c b/block/blk-mq.c > > index 5692c15..197a615 100644 > > --- a/block/blk-mq.c > > +++ b/block/blk-mq.c > > @@ -2270,12 +2270,9 @@ void blk_mq_free_tag_set(struct blk_mq_tag_set *set) > > { > > int i; > > > > - for (i = 0; i < set->nr_hw_queues; i++) { > > - if (set->tags[i]) { > > + for (i = 0; i < set->nr_hw_queues; i++) > > + if (set->tags[i]) > > blk_mq_free_rq_map(set, set->tags[i], i); > > - free_cpumask_var(set->tags[i]->cpumask); > > - } > > - } > > > > kfree(set->tags); > > set->tags = NULL; > >