Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 190b02ed authored by Jens Axboe's avatar Jens Axboe
Browse files

block: fix use-after-free in block flush handling 



A recent commit reused the original request flags for the flush
queue handling. However, for some of the kick flush cases, the
original request was already completed. This caused a use after
free, if blk-mq wasn't used.

Fixes: 84fca1b0 ("block: pass failfast and driver-specific flags to flush requests")
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 77016199

block/blk-flush.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -169,9 +169,11 @@ static bool blk_flush_complete_seq(struct request *rq, 
	struct request_queue *q = rq->q;

	struct request_queue *q = rq->q;

	struct list_head *pending = &fq->flush_queue[fq->flush_pending_idx];

	struct list_head *pending = &fq->flush_queue[fq->flush_pending_idx];

	bool queued = false, kicked;

	bool queued = false, kicked;

	unsigned int cmd_flags;





	BUG_ON(rq->flush.seq & seq);

	BUG_ON(rq->flush.seq & seq);

	rq->flush.seq |= seq;

	rq->flush.seq |= seq;

	cmd_flags = rq->cmd_flags;





	if (likely(!error))

	if (likely(!error))

		seq = blk_flush_cur_seq(rq);

		seq = blk_flush_cur_seq(rq);
@@ -212,7 +214,7 @@ static bool blk_flush_complete_seq(struct request *rq, 
		BUG();

		BUG();

	}

	}





	kicked = blk_kick_flush(q, fq, rq->cmd_flags);

	kicked = blk_kick_flush(q, fq, cmd_flags);

	return kicked | queued;

	return kicked | queued;

}

}