xiao jin c19199167c block: blk_init_allocated_queue() set q->fq as NULL in the fail case ... commit 54648cf1ec upstream. We find the memory use-after-free issue in __blk_drain_queue() on the kernel 4.14. After read the latest kernel 4.18-rc6 we think it has the same problem. Memory is allocated for q->fq in the blk_init_allocated_queue(). If the elevator init function called with error return, it will run into the fail case to free the q->fq. Then the __blk_drain_queue() uses the same memory after the free of the q->fq, it will lead to the unpredictable event. The patch is to set q->fq as NULL in the fail case of blk_init_allocated_queue(). Fixes: commit 7c94e1c157 ("block: introduce blk_flush_queue to drive flush machinery") Cc: <stable@vger.kernel.org> Reviewed-by: Ming Lei <ming.lei@redhat.com> Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com> Signed-off-by: xiao jin <jin.xiao@intel.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> [groeck: backport to v4.4.y/v4.9.y (context change)] Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Alessio Balsini <balsini@android.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-08-11 12:22:18 +02:00
..
partitions
badblocks.c
bio-integrity.c
bio.c	block: do not leak memory in bio_copy_user_iov()	2019-04-17 08:36:46 +02:00
blk-cgroup.c
blk-core.c	block: blk_init_allocated_queue() set q->fq as NULL in the fail case	2019-08-11 12:22:18 +02:00
blk-exec.c
blk-flush.c
blk-integrity.c
blk-ioc.c
blk-lib.c
blk-map.c
blk-merge.c
blk-mq-cpumap.c
blk-mq-pci.c
blk-mq-sysfs.c
blk-mq-tag.c
blk-mq-tag.h
blk-mq.c
blk-mq.h
blk-settings.c
blk-softirq.c
blk-sysfs.c
blk-tag.c
blk-throttle.c
blk-timeout.c
blk.h
bounce.c
bsg-lib.c
bsg.c
cfq-iosched.c
cmdline-parser.c
compat_ioctl.c	take floppy compat ioctls to sodding floppy.c	2019-08-04 09:33:29 +02:00
deadline-iosched.c
elevator.c
genhd.c
ioctl.c
ioprio.c
Kconfig
Kconfig.iosched
Makefile
noop-iosched.c
partition-generic.c
scsi_ioctl.c
t10-pi.c