From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1753243AbbJOOnx (ORCPT <rfc822;w@1wt.eu>);
	Thu, 15 Oct 2015 10:43:53 -0400
Received: from mx1.redhat.com ([209.132.183.28]:40287 "EHLO mx1.redhat.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1751782AbbJOOnv (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Thu, 15 Oct 2015 10:43:51 -0400
From: Jeff Moyer <jmoyer@redhat.com>
To: Junichi Nomura <j-nomura@ce.jp.nec.com>
Cc: Jens Axboe <axboe@kernel.dk>,
        "linux-kernel\@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Keith Busch <keith.busch@intel.com>, "axboe\@fb.com" <axboe@fb.com>
Subject: Re: [PATCH] blk-mq: fix use-after-free in blk_mq_free_tag_set()
References: <20151014050213.GA10302@xzibit.linux.bs1.fc.nec.co.jp>
X-PGP-KeyID: 1F78E1B4
X-PGP-CertKey: F6FE 280D 8293 F72C 65FD  5A58 1FF8 A7CA 1F78 E1B4
X-PCLoadLetter: What the f**k does that mean?
Date: Thu, 15 Oct 2015 10:43:49 -0400
In-Reply-To: <20151014050213.GA10302@xzibit.linux.bs1.fc.nec.co.jp> (Junichi
	Nomura's message of "Wed, 14 Oct 2015 05:02:15 +0000")
Message-ID: <x4937xci44a.fsf@segfault.boston.devel.redhat.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Junichi Nomura <j-nomura@ce.jp.nec.com> writes:

> tags is freed in blk_mq_free_rq_map() and should not be used after that.
> The problem doesn't manifest if CONFIG_CPUMASK_OFFSTACK is false because
> free_cpumask_var() is nop.
>
> tags->cpumask is allocated in blk_mq_init_tags() so it's natural to
> free cpumask in its counter part, blk_mq_free_tags().
>
> Fixes: f26cdc8536ad ("blk-mq: Shared tag enhancements")
> Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
> Cc: Keith Busch <keith.busch@intel.com>
> Cc: Jens Axboe <axboe@fb.com>

Reviewed-by: Jeff Moyer <jmoyer@redhat.com>


> ---
>  block/blk-mq-tag.c | 1 +
>  block/blk-mq.c     | 4 +---
>  2 files changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
> index ed96474..ec2d119 100644
> --- a/block/blk-mq-tag.c
> +++ b/block/blk-mq-tag.c
> @@ -641,6 +641,7 @@ void blk_mq_free_tags(struct blk_mq_tags *tags)
>  {
>  	bt_free(&tags->bitmap_tags);
>  	bt_free(&tags->breserved_tags);
> +	free_cpumask_var(tags->cpumask);
>  	kfree(tags);
>  }
>  
> diff --git a/block/blk-mq.c b/block/blk-mq.c
> index 7785ae9..85f0143 100644
> --- a/block/blk-mq.c
> +++ b/block/blk-mq.c
> @@ -2296,10 +2296,8 @@ void blk_mq_free_tag_set(struct blk_mq_tag_set *set)
>  	int i;
>  
>  	for (i = 0; i < set->nr_hw_queues; i++) {
> -		if (set->tags[i]) {
> +		if (set->tags[i])
>  			blk_mq_free_rq_map(set, set->tags[i], i);
> -			free_cpumask_var(set->tags[i]->cpumask);
> -		}
>  	}
>  
>  	kfree(set->tags);