Re: [PATCH v2] md/raid5-ppl: fix use-after-free in ppl_do_flush()

在 2026/6/22 22:06, Sajal Gupta 写道:

> The loop in ppl_do_flush() continues iterating after calling
> ppl_io_unit_finished(), touching io->pending_flushes and leading to a
> use-after-free.
>
> Add a break statement to stop the loop once io is freed.
>
> Fixes: 1532d9e87e8b ("raid5-ppl: PPL support for disks with write-back cache enabled")
> Reported-by: Dan Carpenter<[email protected]>
> Closes:https://lore.kernel.org/all/[email protected]/
> Signed-off-by: Sajal Gupta<[email protected]>
> ---
> Compile tested only.
>
> Changes in v2:
>   - drop the refcount_t conversion
>
> v1:https://lore.kernel.org/all/[email protected]/
>
>   drivers/md/raid5-ppl.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
Applied to md-7.3

-- 
Thanks,
Kuai