[PATCH] blk-cgroup: fix use-after-free in blkg_conf_open_bdev
Shuangpeng Bai <[email protected]>
| Newsgroups | org.kernel.vger.cgroups,org.kernel.vger.linux-block,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
blkg_conf_open_bdev() holds rq_qos_mutex while checking whether the disk is
still live. On the dead-disk error path, it drops the bdev reference before
unlocking the mutex.
Once that reference is dropped, a concurrent put_disk() can release the
remaining device reference and free the bdev. The subsequent mutex_unlock()
then dereferences bdev->bd_queue from the freed object.
Unlock rq_qos_mutex while the local bdev reference still pins the object.
Drop the reference only after the final bdev access.
Fixes: a13bd91be223 ("block/rq_qos: protect rq_qos apis with a new lock")
Cc: [email protected]
Signed-off-by: Shuangpeng Bai <[email protected]>
---
block/blk-cgroup.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index d9676126c5b5..8628ab6adfa9 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -799,8 +799,8 @@ int blkg_conf_open_bdev(struct blkg_conf_ctx *ctx)
mutex_lock(&bdev->bd_queue->rq_qos_mutex);
if (!disk_live(bdev->bd_disk)) {
- blkdev_put_no_open(bdev);
mutex_unlock(&bdev->bd_queue->rq_qos_mutex);
+ blkdev_put_no_open(bdev);
return -ENODEV;
}
--
2.43.0