From: Mike Krinkin <krinkin.m.u@gmail.com>
Date: Tue, 15 Dec 2015 09:56:40 +0000 (+0300)
Subject: null_blk: fix use-after-free error
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=e8271201462710dbbaa0448b768428606724ca90;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git

null_blk: fix use-after-free error

blk_end_request_all may free request, so we need to save
request_queue pointer before blk_end_request_all call.

The problem was introduced in commit cf8ecc5a8455266f8d51
("null_blk: guarantee device restart in all irq modes")
and causes general protection fault with slab poisoning
enabled.

Fixes: cf8ecc5a8455266f8d51 ("null_blk: guarantee device
       restart in all irq modes")

Signed-off-by: Mike Krinkin <krinkin.m.u@gmail.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
---

diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 8162475d96b5..a428e4ef71fd 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -219,6 +219,9 @@ static void end_cmd(struct nullb_cmd *cmd)
 {
 	struct request_queue *q = NULL;
 
+	if (cmd->rq)
+		q = cmd->rq->q;
+
 	switch (queue_mode)  {
 	case NULL_Q_MQ:
 		blk_mq_end_request(cmd->rq, 0);
@@ -232,9 +235,6 @@ static void end_cmd(struct nullb_cmd *cmd)
 		goto free_cmd;
 	}
 
-	if (cmd->rq)
-		q = cmd->rq->q;
-
 	/* Restart queue if needed, as we are freeing a tag */
 	if (q && !q->mq_ops && blk_queue_stopped(q)) {
 		unsigned long flags;