kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers/block
History
Ming Lei caa5c8a235 ublk: fix handling recovery & reissue in ublk_abort_queue() 
[ Upstream commit 6ee6bd5d4f ]

Commit 8284066946 ("ublk: grab request reference when the request is handled
by userspace") doesn't grab request reference in case of recovery reissue.
Then the request can be requeued & re-dispatch & failed when canceling
uring command.

If it is one zc request, the request can be freed before io_uring
returns the zc buffer back, then cause kernel panic:

[  126.773061] BUG: kernel NULL pointer dereference, address: 00000000000000c8
[  126.773657] #PF: supervisor read access in kernel mode
[  126.774052] #PF: error_code(0x0000) - not-present page
[  126.774455] PGD 0 P4D 0
[  126.774698] Oops: Oops: 0000 [#1] SMP NOPTI
[  126.775034] CPU: 13 UID: 0 PID: 1612 Comm: kworker/u64:55 Not tainted 6.14.0_blk+ #182 PREEMPT(full)
[  126.775676] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014
[  126.776275] Workqueue: iou_exit io_ring_exit_work
[  126.776651] RIP: 0010:ublk_io_release+0x14/0x130 [ublk_drv]

Fixes it by always grabbing request reference for aborting the request.

Reported-by: Caleb Sander Mateos <csander@purestorage.com>
Closes: https://lore.kernel.org/linux-block/CADUfDZodKfOGUeWrnAxcZiLT+puaZX8jDHoj_sfHZCOZwhzz6A@mail.gmail.com/
Fixes: 8284066946 ("ublk: grab request reference when the request is handled by userspace")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250409011444.2142010-2-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-04-20 10:15:05 +02:00
..
aoe block-6.12-20241004 2024-10-04 10:43:44 -07:00
drbd block-6.12-20241018 2024-10-18 15:53:00 -07:00
mtip32xx [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
null_blk block: change blk_mq_add_to_batch() third argument type to bool 2025-03-22 12:54:27 -07:00
rnbd block/rnbd-srv: Add sanity check and remove redundant assignment 2024-08-28 08:50:35 -06:00
xen-blkback xen/blkback: add missing MODULE_DESCRIPTION() macro 2024-07-10 00:21:18 -06:00
zram zram: fix potential UAF of zram table 2025-01-23 17:22:58 +01:00
amiflop.c Merge branch 'for-6.11/block-limits' into for-6.11/block 2024-06-19 08:14:49 -06:00
ataflop.c Merge branch 'for-6.11/block-limits' into for-6.11/block 2024-06-19 08:14:49 -06:00
brd.c brd: decrease the number of allocated pages which discarded 2024-12-05 14:03:10 +01:00
floppy.c floppy: add missing MODULE_DESCRIPTION() macro 2024-07-10 00:22:03 -06:00
Kconfig rust: block: add rnull, Rust null_blk implementation 2024-06-14 07:45:04 -06:00
loop.c loop: fix type of block size 2024-12-05 14:01:13 +01:00
Makefile rust: block: add rnull, Rust null_blk implementation 2024-06-14 07:45:04 -06:00
n64cart.c block: move the nonrot flag to queue_limits 2024-06-19 07:58:28 -06:00
nbd.c nbd: don't allow reconnect after disconnect 2025-02-08 09:56:51 +01:00
pktcdvd.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
ps3disk.c ps3disk: Do not use dev->bounce_size before it is set 2025-02-08 09:56:51 +01:00
ps3vram.c block: pass a queue_limits argument to blk_alloc_disk 2024-02-19 16:58:23 -07:00
rbd.c A small patchset to address bogus I/O errors and ultimately an 2024-07-26 10:34:42 -07:00
rbd_types.h libceph, rbd: replace zero-length array with flexible-array 2020-06-01 13:22:53 +02:00
rnull.rs rust: treewide: switch to our kernel Box type 2025-03-13 13:01:44 +01:00
sunvdc.c block: move the nonrot flag to queue_limits 2024-06-19 07:58:28 -06:00
swim.c block: move the nonrot flag to queue_limits 2024-06-19 07:58:28 -06:00
swim3.c block: move the nonrot flag to queue_limits 2024-06-19 07:58:28 -06:00
swim_asm.S treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ublk_drv.c ublk: fix handling recovery & reissue in ublk_abort_queue() 2025-04-20 10:15:05 +02:00
virtio_blk.c block: change blk_mq_add_to_batch() third argument type to bool 2025-03-22 12:54:27 -07:00
xen-blkfront.c xen-blkfront: fix sector_size propagation to the block layer 2024-07-02 08:58:12 -06:00
z2ram.c z2ram: add missing MODULE_DESCRIPTION() macro 2024-06-19 07:54:00 -06:00