Bart Van Assche
7277cc67b3
skd: Avoid that module unloading triggers a use-after-free
Since put_disk() triggers a disk_release() call and since that
last function calls blk_put_queue() if disk->queue != NULL, clear
the disk->queue pointer before calling put_disk(). This avoids
that unloading the skd kernel module triggers the following
use-after-free:
WARNING: CPU: 8 PID: 297 at lib/refcount.c:128 refcount_sub_and_test+0x70/0x80
refcount_t: underflow; use-after-free.
CPU: 8 PID: 297 Comm: kworker/8:1 Not tainted 4.11.10-300.fc26.x86_64 #1
Workqueue: events work_for_cpu_fn
Call Trace:
dump_stack+0x63/0x84
__warn+0xcb/0xf0
warn_slowpath_fmt+0x5a/0x80
refcount_sub_and_test+0x70/0x80
refcount_dec_and_test+0x11/0x20
kobject_put+0x1f/0x50
blk_put_queue+0x15/0x20
disk_release+0xae/0xf0
device_release+0x32/0x90
kobject_release+0x67/0x170
kobject_put+0x2b/0x50
put_disk+0x17/0x20
skd_destruct+0x5c/0x890 [skd]
skd_pci_probe+0x124d/0x13a0 [skd]
local_pci_probe+0x42/0xa0
work_for_cpu_fn+0x14/0x20
process_one_work+0x19e/0x470
worker_thread+0x1dc/0x4a0
kthread+0x125/0x140
ret_from_fork+0x25/0x30
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Johannes Thumshirn <jthumshirn@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2017-08-18 08:45:29 -06:00
..
2017-07-27 23:14:08 +02:00
2017-07-17 14:44:19 +02:00
2017-07-06 09:41:58 -07:00
2017-07-18 11:37:46 -07:00
2017-07-25 17:17:18 -07:00
2017-08-18 08:45:29 -06:00
2017-07-05 12:31:59 -07:00
2017-07-09 18:48:37 -07:00
2017-06-27 12:13:45 -06:00
2017-07-15 12:44:02 -07:00
2017-07-15 10:59:54 -07:00
2017-07-17 22:43:00 +02:00
2017-07-20 18:57:15 +02:00
2017-07-07 13:55:45 -07:00
2017-07-18 17:01:08 +08:00
2017-07-28 12:17:17 -07:00
2017-07-06 10:17:24 +09:00
2017-07-08 12:36:50 -07:00
2017-07-17 11:56:07 -04:00
2017-06-29 10:37:50 +02:00
2017-06-16 11:48:40 -04:00
2017-07-12 16:26:02 -07:00
2017-07-17 16:13:54 +02:00
2017-07-07 13:30:05 -07:00
2017-07-28 12:32:59 +10:00
2017-07-24 17:38:21 +02:00
2017-07-04 14:28:22 -07:00
2017-07-17 15:00:47 +02:00
2017-07-15 16:38:56 -07:00
2017-07-03 20:55:59 -07:00
2017-07-12 10:04:56 -07:00
2017-08-18 08:36:58 -06:00
2017-06-29 22:58:35 +02:00
2017-07-04 11:48:27 -07:00
2017-07-20 11:24:13 -04:00
2017-07-14 22:53:37 -07:00
2017-07-12 10:00:04 -07:00
2017-07-18 21:59:23 +02:00
2017-07-15 21:25:56 -07:00
2017-07-06 11:32:40 -07:00
2017-07-28 08:06:00 -06:00
2017-07-05 13:13:32 -07:00
2017-07-07 10:24:07 -07:00
2017-08-09 13:09:16 -06:00
2017-07-09 18:48:37 -07:00
2017-07-04 14:47:47 -07:00
2017-07-11 09:55:47 -07:00
2017-07-07 13:55:45 -07:00
2017-07-27 15:57:30 +02:00
2017-07-13 12:07:44 -07:00
2017-07-17 16:38:35 +02:00
2017-07-25 16:37:36 +03:00
2017-07-01 14:30:39 -07:00
2017-07-06 11:30:08 -04:00
2017-08-09 13:09:16 -06:00
2017-08-18 08:36:58 -06:00
2017-07-17 16:15:57 +02:00
2017-07-21 16:58:55 -05:00
2017-07-23 21:02:17 +02:00
2017-07-14 22:24:25 -07:00
2017-07-27 13:43:22 +01:00
2017-06-16 13:22:26 +05:30
2017-07-06 11:38:59 -07:00
2017-07-15 10:59:54 -07:00
2017-07-07 12:40:27 -07:00
2017-07-13 11:47:59 -07:00
2017-06-28 00:38:34 +02:00
2017-07-06 11:40:58 +01:00
2017-07-13 11:49:52 -07:00
2017-07-05 17:09:27 -07:00
2017-07-03 16:52:21 +01:00
2017-06-27 16:21:34 -07:00
2017-07-04 14:47:47 -07:00
2017-07-06 15:38:31 -07:00
2017-07-13 12:15:06 -07:00
2017-07-25 08:44:27 -07:00
2017-06-27 12:13:45 -06:00
2017-07-25 20:10:10 -07:00
2017-07-06 16:24:30 -07:00
2017-07-04 14:47:47 -07:00
2017-07-08 10:41:53 -07:00
2017-07-17 15:00:47 +02:00
2017-07-18 09:04:22 +02:00
2017-07-15 12:44:02 -07:00
2017-07-14 13:12:32 -07:00
2017-07-25 19:46:05 -07:00
2017-07-17 17:04:41 +02:00
2017-07-20 14:40:36 +02:00
2017-07-03 20:27:48 -07:00
2017-07-13 12:23:54 -07:00
2017-07-13 14:27:32 -07:00
2017-07-13 12:38:49 -07:00
2017-07-25 16:37:35 +03:00
2017-07-17 16:48:15 +02:00
2017-07-11 09:59:37 -07:00
2017-07-27 19:55:46 +02:00