releases/4.14.69/block-blk_init_allocated_queue-set-q-fq-as-null-in-the-fail-case.patch

   1 From 54648cf1ec2d7f4b6a71767799c45676a138ca24 Mon Sep 17 00:00:00 2001
   2 From: xiao jin <jin.xiao@intel.com>
   3 Date: Mon, 30 Jul 2018 14:11:12 +0800
   4 Subject: block: blk_init_allocated_queue() set q->fq as NULL in the fail case
   5
   6 From: xiao jin <jin.xiao@intel.com>
   7
   8 commit 54648cf1ec2d7f4b6a71767799c45676a138ca24 upstream.
   9
  10 We find the memory use-after-free issue in __blk_drain_queue()
  11 on the kernel 4.14. After read the latest kernel 4.18-rc6 we
  12 think it has the same problem.
  13
  14 Memory is allocated for q->fq in the blk_init_allocated_queue().
  15 If the elevator init function called with error return, it will
  16 run into the fail case to free the q->fq.
  17
  18 Then the __blk_drain_queue() uses the same memory after the free
  19 of the q->fq, it will lead to the unpredictable event.
  20
  21 The patch is to set q->fq as NULL in the fail case of
  22 blk_init_allocated_queue().
  23
  24 Fixes: commit 7c94e1c157a2 ("block: introduce blk_flush_queue to drive flush machinery")
  25 Cc: <stable@vger.kernel.org>
  26 Reviewed-by: Ming Lei <ming.lei@redhat.com>
  27 Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
  28 Signed-off-by: xiao jin <jin.xiao@intel.com>
  29 Signed-off-by: Jens Axboe <axboe@kernel.dk>
  30 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  31
  32 ---
  33  block/blk-core.c |    1 +
  34  1 file changed, 1 insertion(+)
  35
  36 --- a/block/blk-core.c
  37 +++ b/block/blk-core.c
  38 @@ -1025,6 +1025,7 @@ out_exit_flush_rq:
  39                 q->exit_rq_fn(q, q->fq->flush_rq);
  40  out_free_flush_queue:
  41         blk_free_flush_queue(q->fq);
  42 +       q->fq = NULL;
  43         return -ENOMEM;
  44  }
  45  EXPORT_SYMBOL(blk_init_allocated_queue);