Re: [PATCH v2] md/raid5-ppl: fix use-after-free in ppl_do_flush()
"yu kuai" <[email protected]> Thu, 30 Jul 2026 16:09:34 +0800
| Newsgroups | org.kernel.vger.linux-raid,dev.linux.lists.linux-kernel-mentees,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
在 2026/6/22 22:06, Sajal Gupta 写道:
> The loop in ppl_do_flush() continues iterating after calling
> ppl_io_unit_finished(), touching io->pending_flushes and leading to a
> use-after-free.
>
> Add a break statement to stop the loop once io is freed.
>
> Fixes: 1532d9e87e8b ("raid5-ppl: PPL support for disks with write-back cache enabled")
> Reported-by: Dan Carpenter<[email protected]>
> Closes:https://lore.kernel.org/all/[email protected]/
> Signed-off-by: Sajal Gupta<[email protected]>
> ---
> Compile tested only.
>
> Changes in v2:
> - drop the refcount_t conversion
>
> v1:https://lore.kernel.org/all/[email protected]/
>
> drivers/md/raid5-ppl.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
Applied to md-7.3
--
Thanks,
Kuai