| Message ID | 71712db1ecbe0432055c4976314a57485fff7f18.1493882751.git.osandov@fb.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 05/04/2017 09:31 AM, Omar Sandoval wrote: > From: Bart Van Assche <bart.vanassche@sandisk.com> > > In commit e869b5462f83 ("blk-mq: Unregister debugfs attributes > earlier"), we shuffled the debugfs cleanup around so that the "state" > attribute was removed before we freed the blk-mq data structures. > However, later changes are going to undo that, so we need to explicitly > disallow running a dead queue. > > [Omar: rebased and updated commit message] > Signed-off-by: Omar Sandoval <osandov@fb.com> > Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> > --- > block/blk-mq-debugfs.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > Reviewed-by: Hannes Reinecke <hare@suse.com> Cheers, Hannes
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c index 1579af6fcbed..347fbb8e059c 100644 --- a/block/blk-mq-debugfs.c +++ b/block/blk-mq-debugfs.c @@ -102,6 +102,14 @@ static ssize_t queue_state_write(void *data, const char __user *buf, struct request_queue *q = data; char opbuf[16] = { }, *op; + /* + * The "state" attribute is removed after blk_cleanup_queue() has called + * blk_mq_free_queue(). Return if QUEUE_FLAG_DEAD has been set to avoid + * triggering a use-after-free. + */ + if (blk_queue_dead(q)) + return -ENOENT; + if (count >= sizeof(opbuf)) { pr_err("%s: operation too long\n", __func__); goto inval;