Mehul Rao 25966fc097
ublk: fix NULL pointer dereference in ublk_ctrl_set_size() ...
ublk_ctrl_set_size() unconditionally dereferences ub->ub_disk via
set_capacity_and_notify() without checking if it is NULL.
ub->ub_disk is NULL before UBLK_CMD_START_DEV completes (it is only
assigned in ublk_ctrl_start_dev()) and after UBLK_CMD_STOP_DEV runs
(ublk_detach_disk() sets it to NULL). Since the UBLK_CMD_UPDATE_SIZE
handler performs no state validation, a user can trigger a NULL pointer
dereference by sending UPDATE_SIZE to a device that has been added but
not yet started, or one that has been stopped.
Fix this by checking ub->ub_disk under ub->mutex before dereferencing
it, and returning -ENODEV if the disk is not available.
Fixes: 98b995660bstable@vger.kernel.org
Signed-off-by: Mehul Rao <mehulrao@gmail.com >
Reviewed-by: Ming Lei <ming.lei@redhat.com >
Signed-off-by: Jens Axboe <axboe@kernel.dk >
2026-03-06 04:25:44 -07:00
2026-02-17 09:11:04 -08:00
2026-02-09 20:28:45 -08:00
2026-02-17 09:11:04 -08:00
2026-02-12 17:12:43 -08:00
2026-02-12 12:13:01 -08:00
2026-02-12 12:13:01 -08:00
2026-02-16 09:35:24 -08:00
2026-03-06 04:25:44 -07:00
2026-02-17 09:30:52 -08:00
2026-02-17 09:11:04 -08:00
2026-02-03 20:58:13 -06:00
2026-02-17 09:11:04 -08:00
2026-02-16 09:30:44 -08:00
2026-02-10 19:01:45 -08:00
2026-02-17 09:11:04 -08:00
2026-02-11 18:27:08 -08:00
2026-02-11 17:20:38 -08:00
2026-02-13 15:39:15 -08:00
2026-02-12 16:33:05 -08:00
2026-02-12 16:33:05 -08:00
2026-02-17 11:47:17 -08:00
2026-02-12 15:52:39 -08:00
2026-02-11 15:14:35 +01:00
2026-02-10 18:14:36 -08:00
2026-02-12 15:43:02 -08:00
2026-02-17 09:11:04 -08:00
2026-01-22 17:08:06 +08:00
2026-01-27 16:35:36 +01:00
2026-01-27 16:04:08 +01:00
2026-02-13 12:02:18 -08:00
2026-02-14 14:38:23 -08:00
2026-02-15 08:24:19 -08:00
2026-02-14 11:07:12 +01:00
2026-02-12 12:13:01 -08:00
2026-02-10 20:45:30 -08:00
2026-02-17 09:11:04 -08:00
2026-02-17 09:11:04 -08:00
2026-01-31 00:05:22 +01:00
2026-02-02 17:08:30 +01:00
2026-02-12 17:05:20 -08:00
2026-02-15 08:24:19 -08:00
2026-01-30 16:46:45 +01:00
2026-02-12 19:17:44 -08:00
2026-02-16 09:30:44 -08:00
2026-02-16 11:15:19 -08:00
2026-02-10 20:45:30 -08:00
2026-01-27 15:54:09 +01:00
2026-02-17 08:48:45 -08:00
2026-02-12 12:13:01 -08:00
2026-01-23 21:32:34 -05:00
2026-02-16 11:05:44 -08:00
2026-02-17 09:11:04 -08:00
2026-02-16 09:30:44 -08:00
2026-01-27 15:53:30 +01:00
2026-02-13 15:06:58 -08:00
2026-02-05 17:07:37 +01:00
2026-02-17 09:11:04 -08:00
2026-02-06 20:54:50 -08:00
2026-01-26 12:26:01 +01:00
2026-02-04 13:16:40 -06:00
2026-03-04 08:15:17 -07:00
2026-02-17 09:11:04 -08:00
2026-02-12 12:13:01 -08:00
2026-01-27 10:58:50 +05:30
2026-02-10 21:42:10 -08:00
2026-02-12 16:33:05 -08:00
2026-01-27 16:36:52 -06:00
2026-02-03 19:43:52 +00:00
2026-02-17 11:40:04 -08:00
2026-02-16 09:35:24 -08:00
2026-02-17 09:36:43 -08:00
2026-02-06 10:10:39 -08:00
2026-02-12 18:24:37 -08:00
2026-01-27 15:54:27 +01:00
2026-02-12 12:13:01 -08:00
2026-02-11 17:43:59 -08:00
2026-01-31 16:16:07 -08:00
2026-02-10 18:14:36 -08:00
2026-02-16 11:05:44 -08:00
2026-02-03 09:23:12 -07:00
2026-01-24 16:53:02 +01:00
2026-02-16 09:30:44 -08:00
2026-02-12 15:43:02 -08:00
2026-02-13 12:02:18 -08:00
2026-01-27 15:53:49 +01:00
2026-02-17 11:40:04 -08:00
2026-02-17 10:07:13 -08:00
2026-02-17 09:11:04 -08:00
2026-01-23 19:24:39 +01:00
2026-02-17 09:20:58 -08:00
2026-02-12 15:43:02 -08:00
2026-01-21 16:30:52 +01:00
2026-02-10 13:22:50 -08:00
2026-02-17 09:36:43 -08:00
2026-02-17 09:30:52 -08:00
2026-02-12 15:43:02 -08:00
2026-02-17 09:36:43 -08:00
2026-02-09 12:21:32 -05:00
2026-02-12 15:52:39 -08:00
2026-02-13 12:02:18 -08:00
2026-02-16 11:10:33 -08:00
2026-02-15 10:20:37 -08:00
2026-02-13 12:02:18 -08:00
2026-02-16 12:21:22 -08:00
2026-02-10 19:01:45 -08:00
2026-02-04 20:45:26 +05:30
25966fc097