On 7/30/18 12:11 AM, xiao jin wrote: > We find the memory use-after-free issue in __blk_drain_queue() > on the kernel 4.14. After read the latest kernel 4.18-rc6 we > think it has the same problem. > > Memory is allocated for q->fq in the blk_init_allocated_queue(). > If the elevator init function called with error return, it will > run into the fail case to free the q->fq. > > Then the __blk_drain_queue() uses the same memory after the free > of the q->fq, it will lead to the unpredictable event. > > The patch is to set q->fq as NULL in the fail case of > blk_init_allocated_queue(). Applied, thanks. -- Jens Axboe
