From patchwork Wed May 3 19:18:57 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Omar Sandoval X-Patchwork-Id: 9710307 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 275946021C for ; Wed, 3 May 2017 19:19:31 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1454428663 for ; Wed, 3 May 2017 19:19:31 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0913628668; Wed, 3 May 2017 19:19:31 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.4 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 93F5328663 for ; Wed, 3 May 2017 19:19:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756466AbdECTT3 (ORCPT ); Wed, 3 May 2017 15:19:29 -0400 Received: from mail-pg0-f54.google.com ([74.125.83.54]:34679 "EHLO mail-pg0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756404AbdECTTO (ORCPT ); Wed, 3 May 2017 15:19:14 -0400 Received: by mail-pg0-f54.google.com with SMTP id v1so83102367pgv.1 for ; Wed, 03 May 2017 12:19:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=osandov-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :in-reply-to:references; bh=jTYdVAVEM3uTRWrC8RTJ01J0vI8P620kL9lJqHzhTFs=; b=f72BHd7TIXYdY5P1FAVuDc5hsAQoDcpdq8UMS+2MgC9XhPoOIvCFKJphIg2dQQxfg2 kkhN2/gKwWINHb1akmXABQ8Qv4R2+sku5gkLseLyxfVgEXYNs85tSKhKU61o1ebTRDuy lVwr4enBJIWFh2bM+Vy9hMxzpTZcb6nPZ4WsIOWAjiuHGN01DuUyDKnmT6GFV5FlsTlm s3C03IhHGwqee+g7bR+QtEH4fv8epSpUDQzIuYva2Gwu39h13d0cbC5yh+ehFSG6SODy vpAUfiSMl/JQWU29QKnrYKPoFXXg0VB+m5viwzkk86vSiYQuhdjAfHzfPJTpwCuJZpaT AO3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:in-reply-to:references; bh=jTYdVAVEM3uTRWrC8RTJ01J0vI8P620kL9lJqHzhTFs=; b=mkn0G6UxdVf6KFYEMmNRPEXUoD1AWkaz+md0PEzJt+H4I7uT0OkFWzRGbczTyjHIYX GBQoVmbZdEfg1pVudkFYRv/d9xRcoqA+i8ZBB6tspsTjfe7SMtqsfEiQrkgrwGksVU+Y yampGLtJ+b8Jgd37NWwDnLTCogn6La06r5TdZ/77Jn4KgjgBJvoEejVzi3Y9qqaGJgF8 G0iytZ//TXy6RQOJ5sUnO6Vn5KaM3XclbVsoxIIsa8Wu8nL5pEtaaEEqg5uUll+SVibY J+M1hFfgFuaG6dfH8getUII6g+JBk4vF2Mgokt69Tzi2YV5fdmDmOG7gdKgbjmoFVqjd 3Dfw== X-Gm-Message-State: AN3rC/7+yHbaOtHkR+UTADciRVjyOgcv80/fkEIcxYXbUVattcosoHcx rIpE51bBldaD5zBD X-Received: by 10.98.149.196 with SMTP id c65mr6568426pfk.37.1493839153663; Wed, 03 May 2017 12:19:13 -0700 (PDT) Received: from vader.thefacebook.com ([2620:10d:c090:180::1:5612]) by smtp.gmail.com with ESMTPSA id p6sm38216497pgn.9.2017.05.03.12.19.12 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 03 May 2017 12:19:13 -0700 (PDT) From: Omar Sandoval To: Jens Axboe , linux-block@vger.kernel.org Cc: Bart Van Assche , kernel-team@fb.com Subject: [PATCH 4/9] blk-mq: Do not invoke queue operations on a dead queue Date: Wed, 3 May 2017 12:18:57 -0700 Message-Id: X-Mailer: git-send-email 2.12.2 In-Reply-To: References: In-Reply-To: References: Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Bart Van Assche In commit e869b5462f83 ("blk-mq: Unregister debugfs attributes earlier"), we shuffled the debugfs cleanup around so that the "state" attribute was removed before we freed the blk-mq data structures. However, later changes are going to undo that, so we need to explicitly disallow running a dead queue. [Omar: rebased and updated commit message] Signed-off-by: Omar Sandoval Signed-off-by: Bart Van Assche --- block/blk-mq-debugfs.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c index 00cc89c34590..48b9f59acd91 100644 --- a/block/blk-mq-debugfs.c +++ b/block/blk-mq-debugfs.c @@ -102,6 +102,14 @@ static ssize_t queue_state_write(void *data, const char __user *buf, struct request_queue *q = data; char op[16] = { }, *s; + /* + * The "state" attribute is removed after blk_cleanup_queue() has called + * blk_mq_free_queue(). Return if QUEUE_FLAG_DEAD has been set to avoid + * triggering a use-after-free. + */ + if (blk_queue_dead(q)) + return -ENOENT; + if (copy_from_user(op, buf, min(count, sizeof(op) - 1))) return -EFAULT; s = op;