Commit 61febef4 authored by Jens Axboe's avatar Jens Axboe

dm-rq: don't dereference request payload after ending request

Bart reported a case where dm would crash with use-after-free
poison. This is due to dm_softirq_done() accessing memory
associated with a request after calling end_request on it.
This is most visible on !blk-mq, since we free the memory
immediately for that case.
Reported-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
Suggested-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Fixes: eb8db831 ("dm: always defer request allocation to the owner of the request_queue")
Signed-off-by: default avatarJens Axboe <axboe@fb.com>
parent d38d3515
......@@ -328,13 +328,15 @@ static void dm_softirq_done(struct request *rq)
int rw;
if (!clone) {
rq_end_stats(tio->md, rq);
struct mapped_device *md = tio->md;
rq_end_stats(md, rq);
rw = rq_data_dir(rq);
if (!rq->q->mq_ops)
blk_end_request_all(rq, tio->error);
else
blk_mq_end_request(rq, tio->error);
rq_completed(tio->md, rw, false);
rq_completed(md, rw, false);
return;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment