Re: [bug report] BUG: KASAN: slab-use-after-free in bfq_setup_cooperator

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mar 07, 2023 / 18:28, Yu Kuai wrote:
> Hi, Jan
> 
> 在 2023/03/07 18:20, Jan Kara 写道:

[...]

> > So rather doing something like:
> > 
> > 		bfqq_data->stable_merge_bfqq = NULL;
> > 		new_bfqq = bfq_setup_stable_merge(bfqd, bfqq,
> > 						  stable_merge_bfqq, bfqq_data);
> > 		bfq_put_stable_ref(stable_merge_bfqq);
> > 		return new_bfqq;
> > 
> > should work in bfq_setup_cooperator().
> 
> Yes, this will work.

Based on the description above, I quickly created the dirty patch below, and
confirmed it avoids the BUG. Looks good. Jan, Yu, thanks for the quick actions.
Let me wait for the formal patch.

diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 8a8d4441519c..50eb435efed0 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -2932,15 +2932,15 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
 					   msecs_to_jiffies(bfq_late_stable_merging))) {
 			struct bfq_queue *stable_merge_bfqq =
 				bfqq_data->stable_merge_bfqq;
+			static struct bfq_queue *new_bfqq;
 
 			/* deschedule stable merge, because done or aborted here */
-			bfq_put_stable_ref(stable_merge_bfqq);
-
 			bfqq_data->stable_merge_bfqq = NULL;
-
-			return bfq_setup_stable_merge(bfqd, bfqq,
-						      stable_merge_bfqq,
-						      bfqq_data);
+			new_bfqq = bfq_setup_stable_merge(bfqd, bfqq,
+							  stable_merge_bfqq,
+							  bfqq_data);
+			bfq_put_stable_ref(stable_merge_bfqq);
+			return new_bfqq;
 		}
 	}
 


-- 
Shin'ichiro Kawasaki




[Index of Archives]     [Linux RAID]     [Linux SCSI]     [Linux ATA RAID]     [IDE]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Device Mapper]

  Powered by Linux