Skip to content

Commit 54648cf

Browse files
JinXiao-Intelaxboe
authored andcommitted
block: blk_init_allocated_queue() set q->fq as NULL in the fail case
We find the memory use-after-free issue in __blk_drain_queue() on the kernel 4.14. After read the latest kernel 4.18-rc6 we think it has the same problem. Memory is allocated for q->fq in the blk_init_allocated_queue(). If the elevator init function called with error return, it will run into the fail case to free the q->fq. Then the __blk_drain_queue() uses the same memory after the free of the q->fq, it will lead to the unpredictable event. The patch is to set q->fq as NULL in the fail case of blk_init_allocated_queue(). Fixes: commit 7c94e1c ("block: introduce blk_flush_queue to drive flush machinery") Cc: <stable@vger.kernel.org> Reviewed-by: Ming Lei <ming.lei@redhat.com> Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com> Signed-off-by: xiao jin <jin.xiao@intel.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
1 parent f7f1fc3 commit 54648cf

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

Diff for: block/blk-core.c

+1
Original file line numberDiff line numberDiff line change
@@ -1184,6 +1184,7 @@ int blk_init_allocated_queue(struct request_queue *q)
11841184
q->exit_rq_fn(q, q->fq->flush_rq);
11851185
out_free_flush_queue:
11861186
blk_free_flush_queue(q->fq);
1187+
q->fq = NULL;
11871188
return -ENOMEM;
11881189
}
11891190
EXPORT_SYMBOL(blk_init_allocated_queue);

0 commit comments

Comments
 (0)