ublk: fix use-after-free in ublk_cancel_cmd()

When ublk_reset_ch_dev() clears io->cmd via ublk_queue_reinit()
concurrently with ublk_cancel_cmd(), ublk_cancel_cmd() can read a
stale pointer and pass it to io_uring_cmd_done(), causing a
use-after-free.

Fix by synchronizing the two paths with ubq->cancel_lock:

- ublk_cancel_cmd(): read and clear io->cmd under cancel_lock,
  then call io_uring_cmd_done() on the saved local copy outside
  the lock.

- ublk_reset_ch_dev(): hold cancel_lock across ublk_queue_reinit()
  so that io->cmd and io->flags are cleared atomically with respect
  to ublk_cancel_cmd().

Fixes: 216c8f5ef0f2 ("ublk: replace monitor with cancelable uring_cmd")
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20260508123746.242018-1-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 57ec900f0ce0f60fc33a02f08d18c07eef7712eb..6d13f1481de053bb51189093265935e6d3880d63 100644 (file)
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -2411,8 +2411,14 @@ static void ublk_reset_ch_dev(struct ublk_device *ub)
 {
        int i;
 
-       for (i = 0; i < ub->dev_info.nr_hw_queues; i++)
-               ublk_queue_reinit(ub, ublk_get_queue(ub, i));
+       for (i = 0; i < ub->dev_info.nr_hw_queues; i++) {
+               struct ublk_queue *ubq = ublk_get_queue(ub, i);
+
+               /* Sync with ublk_cancel_cmd() */
+               spin_lock(&ubq->cancel_lock);
+               ublk_queue_reinit(ub, ubq);
+               spin_unlock(&ubq->cancel_lock);
+       }
 
        /* set to NULL, otherwise new tasks cannot mmap io_cmd_buf */
        ub->mm = NULL;
@@ -2753,6 +2759,7 @@ static void ublk_cancel_cmd(struct ublk_queue *ubq, unsigned tag,
 {
        struct ublk_io *io = &ubq->ios[tag];
        struct ublk_device *ub = ubq->dev;
+       struct io_uring_cmd *cmd = NULL;
        struct request *req;
        bool done;
 
@@ -2775,12 +2782,15 @@ static void ublk_cancel_cmd(struct ublk_queue *ubq, unsigned tag,
 
        spin_lock(&ubq->cancel_lock);
        done = !!(io->flags & UBLK_IO_FLAG_CANCELED);
-       if (!done)
+       if (!done) {
                io->flags |= UBLK_IO_FLAG_CANCELED;
+               cmd = io->cmd;
+               io->cmd = NULL;
+       }
        spin_unlock(&ubq->cancel_lock);
 
-       if (!done)
-               io_uring_cmd_done(io->cmd, UBLK_IO_RES_ABORT, issue_flags);
+       if (!done && cmd)
+               io_uring_cmd_done(cmd, UBLK_IO_RES_ABORT, issue_flags);
 }
 
 /*