Re: [bug report] BUG: KASAN: use-after-free in bic_set_bfqq

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Jan 12, 2023 / 19:53, Yu Kuai wrote:
> Hi,
> 
> 在 2023/01/12 19:47, Yu Kuai 写道:
> > Thanks for the report, is the problem easy to reporduce? If so, can you
> > try the following patch?
> > 
> > diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
> > index 1b2829e99dad..81d2f401fa3f 100644
> > --- a/block/bfq-cgroup.c
> > +++ b/block/bfq-cgroup.c
> > @@ -771,8 +771,8 @@ static void __bfq_bic_change_cgroup(struct bfq_data
> > *bfqd,
> >                                   * request from the old cgroup.
> >                                   */
> >                                  bfq_put_cooperator(sync_bfqq);
> > -                               bfq_release_process_ref(bfqd, sync_bfqq);
> >                                  bic_set_bfqq(bic, NULL, true);
> > +                               bfq_release_process_ref(bfqd, sync_bfqq);
> >                          }
> >                  }
> >          }
> > 
> Just in case you hit the problem in another place, please using the
> following patch:
> 
> diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
> index 1b2829e99dad..81d2f401fa3f 100644
> --- a/block/bfq-cgroup.c
> +++ b/block/bfq-cgroup.c
> @@ -771,8 +771,8 @@ static void __bfq_bic_change_cgroup(struct bfq_data
> *bfqd,
>                                  * request from the old cgroup.
>                                  */
>                                 bfq_put_cooperator(sync_bfqq);
> -                               bfq_release_process_ref(bfqd, sync_bfqq);
>                                 bic_set_bfqq(bic, NULL, true);
> +                               bfq_release_process_ref(bfqd, sync_bfqq);
>                         }
>                 }
>         }
> diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
> index 16f43bbc575a..687285612e57 100644
> --- a/block/bfq-iosched.c
> +++ b/block/bfq-iosched.c
> @@ -5425,9 +5425,10 @@ static void bfq_check_ioprio_change(struct bfq_io_cq
> *bic, struct bio *bio)
> 
>         bfqq = bic_to_bfqq(bic, false);
>         if (bfqq) {
> -               bfq_release_process_ref(bfqd, bfqq);
> +               struct bfq_queue *old_bfqq = bfqq;
>                 bfqq = bfq_get_queue(bfqd, bio, false, bic, true);
>                 bic_set_bfqq(bic, bfqq, false);
> +               bfq_release_process_ref(bfqd, old_bfqq);
>         }
> 
>         bfqq = bic_to_bfqq(bic, true);
> 

Ah, I've just noticed this e-mail. Will test this patch tomorrow.

-- 
Shin'ichiro Kawasaki




[Index of Archives]     [Linux RAID]     [Linux SCSI]     [Linux ATA RAID]     [IDE]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Device Mapper]

  Powered by Linux