Merge "block: Fix use-after-free issue accessing struct io_cq" (5ce437c2) · Commits · e / devices / android_kernel_fairphone_FP4

block/blk-ioc.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -87,6 +87,7 @@ static void ioc_destroy_icq(struct io_cq *icq)
		* making it impossible to determine icq_cache. Record it in @icq.
		*/
		icq->__rcu_icq_cache = et->icq_cache;
		icq->flags \|= ICQ_DESTROYED;
		call_rcu(&icq->__rcu_head, icq_free_icq_rcu);
		}

		@@ -230,15 +231,21 @@ static void __ioc_clear_queue(struct list_head *icq_list)
		{
		unsigned long flags;

		rcu_read_lock();
		while (!list_empty(icq_list)) {
		struct io_cq *icq = list_entry(icq_list->next,
		struct io_cq, q_node);
		struct io_context *ioc = icq->ioc;

		spin_lock_irqsave(&ioc->lock, flags);
		if (icq->flags & ICQ_DESTROYED) {
		spin_unlock_irqrestore(&ioc->lock, flags);
		continue;
		}
		ioc_destroy_icq(icq);
		spin_unlock_irqrestore(&ioc->lock, flags);
		}
		rcu_read_unlock();
		}

		/**

+1 −0