From 18d4d7d0571f5acc9de638ea3a33e8064deaceca Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Thu, 4 May 2017 00:31:29 -0700 Subject: blk-mq: Do not invoke queue operations on a dead queue In commit e869b5462f83 ("blk-mq: Unregister debugfs attributes earlier"), we shuffled the debugfs cleanup around so that the "state" attribute was removed before we freed the blk-mq data structures. However, later changes are going to undo that, so we need to explicitly disallow running a dead queue. [Omar: rebased and updated commit message] Signed-off-by: Omar Sandoval Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe --- block/blk-mq-debugfs.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'block/blk-mq-debugfs.c') diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c index 1579af6fcbed..347fbb8e059c 100644 --- a/block/blk-mq-debugfs.c +++ b/block/blk-mq-debugfs.c @@ -102,6 +102,14 @@ static ssize_t queue_state_write(void *data, const char __user *buf, struct request_queue *q = data; char opbuf[16] = { }, *op; + /* + * The "state" attribute is removed after blk_cleanup_queue() has called + * blk_mq_free_queue(). Return if QUEUE_FLAG_DEAD has been set to avoid + * triggering a use-after-free. + */ + if (blk_queue_dead(q)) + return -ENOENT; + if (count >= sizeof(opbuf)) { pr_err("%s: operation too long\n", __func__); goto inval; -- cgit