Messages in this thread | | | From | Bart Van Assche <> | Subject | Re: [PATCH] blk_init_allocated_queue() set q->fq as NULL in the fail case | Date | Mon, 30 Jul 2018 05:11:58 +0000 |
| |
On Mon, 2018-07-30 at 10:03 +0800, xiao jin wrote: > We find the memory use-after-free issue in __blk_drain_queue() > on the kernel 4.14. After read the latest kernel 4.18-rc6 we > think it has the same problem. > > Memory is allocated for q->fq in the blk_init_allocated_queue(). > If the elevator init function called with error return, it will > run into the fail case to free the q->fq. > > Then the __blk_drain_queue() uses the same memory after the free > of the q->fq, it will lead to the unpredictable event. > > The patch is to set q->fq as NULL in the fail case of > blk_init_allocated_queue().
Please add "Fixes:" and "Cc: stable" tags to this patch.
Thanks,
Bart.
| |