From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753356AbbJOOrF (ORCPT ); Thu, 15 Oct 2015 10:47:05 -0400 Received: from mga09.intel.com ([134.134.136.24]:64444 "EHLO mga09.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751633AbbJOOrD (ORCPT ); Thu, 15 Oct 2015 10:47:03 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.17,686,1437462000"; d="scan'208";a="665011976" Date: Thu, 15 Oct 2015 14:47:02 +0000 (UTC) From: Keith Busch X-X-Sender: vmware@localhost.lm.intel.com To: Junichi Nomura cc: Jens Axboe , "linux-kernel@vger.kernel.org" , Keith Busch , "axboe@fb.com" Subject: Re: [PATCH] blk-mq: fix use-after-free in blk_mq_free_tag_set() In-Reply-To: <20151014050213.GA10302@xzibit.linux.bs1.fc.nec.co.jp> Message-ID: References: <20151014050213.GA10302@xzibit.linux.bs1.fc.nec.co.jp> User-Agent: Alpine 2.00 (LNX 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 13 Oct 2015, Junichi Nomura wrote: > tags is freed in blk_mq_free_rq_map() and should not be used after that. > The problem doesn't manifest if CONFIG_CPUMASK_OFFSTACK is false because > free_cpumask_var() is nop. > > tags->cpumask is allocated in blk_mq_init_tags() so it's natural to > free cpumask in its counter part, blk_mq_free_tags(). Thanks for the fix. Reviewed-by: Keith Busch > Fixes: f26cdc8536ad ("blk-mq: Shared tag enhancements") > Signed-off-by: Jun'ichi Nomura > Cc: Keith Busch > Cc: Jens Axboe