null_blk: fix use-after-free error
blk_end_request_all may free request, so we need to save request_queue pointer before blk_end_request_all call. The problem was introduced in commitcf8ecc5a84
("null_blk: guarantee device restart in all irq modes") and causes general protection fault with slab poisoning enabled. Fixes:cf8ecc5a84
("null_blk: guarantee device restart in all irq modes") Signed-off-by: Mike Krinkin <krinkin.m.u@gmail.com> Reviewed-by: Ming Lei <tom.leiming@gmail.com> Signed-off-by: Jens Axboe <axboe@fb.com>
This commit is contained in:
Родитель
23688bf4f8
Коммит
e827120146
|
@ -219,6 +219,9 @@ static void end_cmd(struct nullb_cmd *cmd)
|
||||||
{
|
{
|
||||||
struct request_queue *q = NULL;
|
struct request_queue *q = NULL;
|
||||||
|
|
||||||
|
if (cmd->rq)
|
||||||
|
q = cmd->rq->q;
|
||||||
|
|
||||||
switch (queue_mode) {
|
switch (queue_mode) {
|
||||||
case NULL_Q_MQ:
|
case NULL_Q_MQ:
|
||||||
blk_mq_end_request(cmd->rq, 0);
|
blk_mq_end_request(cmd->rq, 0);
|
||||||
|
@ -232,9 +235,6 @@ static void end_cmd(struct nullb_cmd *cmd)
|
||||||
goto free_cmd;
|
goto free_cmd;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (cmd->rq)
|
|
||||||
q = cmd->rq->q;
|
|
||||||
|
|
||||||
/* Restart queue if needed, as we are freeing a tag */
|
/* Restart queue if needed, as we are freeing a tag */
|
||||||
if (q && !q->mq_ops && blk_queue_stopped(q)) {
|
if (q && !q->mq_ops && blk_queue_stopped(q)) {
|
||||||
unsigned long flags;
|
unsigned long flags;
|
||||||
|
|
Загрузка…
Ссылка в новой задаче