Skip to content

blk-cgroup: fix use-after-free in blkg_conf_open_bdev - #108

Open
blktests-ci-block-trial[bot] wants to merge 2 commits into
master_basefrom
series/627=>master
Open

blk-cgroup: fix use-after-free in blkg_conf_open_bdev#108
blktests-ci-block-trial[bot] wants to merge 2 commits into
master_basefrom
series/627=>master

Conversation

@blktests-ci-block-trial

@blktests-ci-block-trial blktests-ci-block-trial Bot commented Aug 17, 2026

Copy link
Copy Markdown

Pull request for series with
subject: blk-cgroup: fix use-after-free in blkg_conf_open_bdev
version: 1
url: http://redsun45:8000/project/linux-block/list/?series=627

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 17, 2026

Copy link
Copy Markdown
Author

Upstream branch: 8d3ae59
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 18, 2026

Copy link
Copy Markdown
Author

Upstream branch: ff68e5f
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 18, 2026

Copy link
Copy Markdown
Author

Upstream branch: 0f23d56
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 18, 2026

Copy link
Copy Markdown
Author

Upstream branch: 1200d84
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 19, 2026

Copy link
Copy Markdown
Author

Upstream branch: 3a0dd7b
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 19, 2026

Copy link
Copy Markdown
Author

Upstream branch: b126f6f
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 19, 2026

Copy link
Copy Markdown
Author

Upstream branch: bd5f485
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 19, 2026

Copy link
Copy Markdown
Author

Upstream branch: 59e6295
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 19, 2026

Copy link
Copy Markdown
Author

Upstream branch: 98f21c5
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 19, 2026

Copy link
Copy Markdown
Author

Upstream branch: cb8a75e
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 20, 2026

Copy link
Copy Markdown
Author

Upstream branch: a4ff2be
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 20, 2026

Copy link
Copy Markdown
Author

Upstream branch: 9d2ed02
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 20, 2026

Copy link
Copy Markdown
Author

Upstream branch: c84d3e3
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 20, 2026

Copy link
Copy Markdown
Author

Upstream branch: 77ae27f
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 21, 2026

Copy link
Copy Markdown
Author

Upstream branch: 7f063b2
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 21, 2026

Copy link
Copy Markdown
Author

Upstream branch: 818bebe
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@shuangpeng-kernel @kawasaki
blk-cgroup: fix use-after-free in blkg_conf_open_bdev
d591ed5 
blkg_conf_open_bdev() holds rq_qos_mutex while checking whether the disk is
still live. On the dead-disk error path, it drops the bdev reference before
unlocking the mutex.

Once that reference is dropped, a concurrent put_disk() can release the
remaining device reference and free the bdev. The subsequent mutex_unlock()
then dereferences bdev->bd_queue from the freed object.

Unlock rq_qos_mutex while the local bdev reference still pins the object.
Drop the reference only after the final bdev access.

Fixes: a13bd91 ("block/rq_qos: protect rq_qos apis with a new lock")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
@blktests-ci-block-trial

blktests-ci-block-trial Bot commented Aug 21, 2026

Copy link
Copy Markdown
Author

Upstream branch: 531ed94
series: http://redsun45:8000/project/linux-block/list/?series=627
version: 1

@blktests-ci-block-trial
blktests-ci-block-trial Bot force-pushed the master_base branch 5 times, most recently from 234c2d8 to 7759c50 Compare August 24, 2026 02:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

master new V1-ci-fail V1

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@kawasaki @shuangpeng-kernel