Ming Lei f7700a4415
ublk: fix use-after-free in ublk_cancel_cmd() ...
When ublk_reset_ch_dev() clears io->cmd via ublk_queue_reinit()
concurrently with ublk_cancel_cmd(), ublk_cancel_cmd() can read a
stale pointer and pass it to io_uring_cmd_done(), causing a
use-after-free.
Fix by synchronizing the two paths with ubq->cancel_lock:
- ublk_cancel_cmd(): read and clear io->cmd under cancel_lock,
then call io_uring_cmd_done() on the saved local copy outside
the lock.
- ublk_reset_ch_dev(): hold cancel_lock across ublk_queue_reinit()
so that io->cmd and io->flags are cleared atomically with respect
to ublk_cancel_cmd().
Fixes: 216c8f5ef0tom.leiming@gmail.com >
Link: https://patch.msgid.link/20260508123746.242018-1-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk >
2026-05-08 06:44:42 -06:00
2026-04-15 08:45:00 -07:00
2026-04-23 12:29:22 -07:00
2026-04-24 13:23:50 -07:00
2026-04-15 15:03:01 -07:00
2026-04-23 12:21:14 -07:00
2026-04-24 12:11:26 -07:00
2026-05-08 06:44:42 -06:00
2026-04-13 09:19:42 -04:00
2026-04-24 13:23:50 -07:00
2026-04-27 15:52:51 -06:00
2026-04-25 16:20:52 -07:00
2026-04-26 14:03:20 -07:00
2026-04-24 13:23:50 -07:00
2026-04-06 09:04:53 +02:00
2026-04-17 14:09:02 -07:00
2026-04-14 17:10:15 -07:00
2026-04-16 17:37:03 +08:00
2026-04-17 15:52:58 -07:00
2026-04-21 14:12:01 -07:00
2026-04-04 03:15:39 +09:00
2026-04-17 10:29:01 -07:00
2026-04-24 11:44:52 -07:00
2026-04-12 08:27:34 -07:00
2026-04-14 15:32:39 -07:00
2026-04-24 09:54:45 -07:00
2026-04-10 11:21:06 -03:00
2026-04-06 09:04:53 +02:00
2026-04-24 11:59:46 -07:00
2026-04-24 11:44:52 -07:00
2026-04-22 18:36:40 -07:00
2026-04-02 22:33:44 +02:00
2026-04-12 23:29:31 -07:00
2026-04-24 11:44:52 -07:00
2026-04-15 14:37:32 -07:00
2026-04-06 09:43:18 -05:00
2026-04-24 13:23:50 -07:00
2026-04-20 00:03:38 +02:00
2026-04-12 22:06:02 +02:00
2026-04-24 13:23:50 -07:00
2026-04-21 08:22:18 -07:00
2026-04-22 18:36:40 -07:00
2026-04-07 10:06:50 +02:00
2026-04-17 11:12:42 -07:00
2026-04-17 07:18:03 -07:00
2026-04-09 13:49:19 +01:00
2026-04-28 20:44:38 +08:00
2026-04-17 14:18:55 -07:00
2026-04-17 11:12:42 -07:00
2026-04-20 11:31:01 -07:00
2026-04-24 13:23:50 -07:00
2026-04-10 10:29:58 +02:00
2026-04-17 17:57:04 -07:00
2026-04-24 13:23:50 -07:00
2026-04-24 09:41:58 -07:00
2026-04-13 20:10:58 -07:00
2026-04-15 14:41:21 -07:00
2026-04-13 10:40:26 -07:00
2026-04-27 15:47:21 -06:00
2026-04-06 09:04:53 +02:00
2026-04-18 11:29:14 -07:00
2026-04-17 15:46:46 +02:00
2026-04-24 09:54:45 -07:00
2026-04-23 11:22:16 -07:00
2026-04-14 16:48:56 -07:00
2026-04-17 10:22:08 -07:00
2026-04-18 16:59:09 -07:00
2026-04-20 12:02:24 -07:00
2026-04-08 12:01:37 +02:00
2026-04-19 08:47:40 -07:00
2026-04-23 08:37:07 -07:00
2026-04-24 13:06:25 -07:00
2026-04-17 14:18:55 -07:00
2026-04-20 16:46:22 -07:00
2026-04-23 08:57:24 -07:00
2026-04-06 09:37:51 -05:00
2026-04-25 16:39:03 -07:00
2026-04-22 11:13:45 -07:00
2026-04-27 15:52:51 -06:00
2026-04-17 14:18:55 -07:00
2026-04-17 10:16:53 -07:00
2026-04-24 13:16:36 -07:00
2026-04-24 13:23:50 -07:00
2026-04-21 08:22:18 -07:00
2026-04-16 20:34:34 -07:00
2026-04-14 08:55:18 -07:00
2026-04-10 13:10:28 +02:00
2026-04-19 08:44:41 -07:00
2026-04-08 22:27:16 -04:00
2026-04-05 13:53:44 -07:00
2026-04-21 08:22:18 -07:00
2026-04-04 00:47:50 +02:00
2026-04-21 12:01:22 -06:00
2026-04-23 16:50:42 -07:00
2026-04-22 17:02:55 +02:00
2026-04-26 09:51:29 -07:00
2026-04-15 12:59:16 -07:00
2026-04-03 10:55:12 +02:00
2026-04-07 21:06:59 +02:00
2026-04-21 08:22:18 -07:00
2026-04-23 10:24:02 -07:00
2026-04-23 10:24:02 -07:00
f7700a4415