Ming Lei 5d34a30efa ublk: fix handling recovery & reissue in ublk_abort_queue() ...

[ Upstream commit 6ee6bd5d4f ]

Commit 8284066946 ("ublk: grab request reference when the request is handled
by userspace") doesn't grab request reference in case of recovery reissue.
Then the request can be requeued & re-dispatch & failed when canceling
uring command.

If it is one zc request, the request can be freed before io_uring
returns the zc buffer back, then cause kernel panic:

[  126.773061] BUG: kernel NULL pointer dereference, address: 00000000000000c8
[  126.773657] #PF: supervisor read access in kernel mode
[  126.774052] #PF: error_code(0x0000) - not-present page
[  126.774455] PGD 0 P4D 0
[  126.774698] Oops: Oops: 0000 [#1] SMP NOPTI
[  126.775034] CPU: 13 UID: 0 PID: 1612 Comm: kworker/u64:55 Not tainted 6.14.0_blk+ #182 PREEMPT(full)
[  126.775676] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014
[  126.776275] Workqueue: iou_exit io_ring_exit_work
[  126.776651] RIP: 0010:ublk_io_release+0x14/0x130 [ublk_drv]

Fixes it by always grabbing request reference for aborting the request.

Reported-by: Caleb Sander Mateos <csander@purestorage.com>
Closes: https://lore.kernel.org/linux-block/CADUfDZodKfOGUeWrnAxcZiLT+puaZX8jDHoj_sfHZCOZwhzz6A@mail.gmail.com/
Fixes: 8284066946 ("ublk: grab request reference when the request is handled by userspace")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250409011444.2142010-2-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-04-20 10:17:29 +02:00

..

aoe

Merge tag 'block-6.12-20241004' of git://git.kernel.dk/linux

2024-10-04 10:43:44 -07:00

drbd

Merge tag 'block-6.12-20241018' of git://git.kernel.dk/linux

2024-10-18 15:53:00 -07:00

mtip32xx

mtip32xx: Replace deprecated PCI functions

2024-11-06 07:54:50 -07:00

null_blk

block: change blk_mq_add_to_batch() third argument type to bool

2025-03-22 12:56:57 -07:00

rnbd

block/rnbd-srv: Add sanity check and remove redundant assignment

2024-08-28 08:50:35 -06:00

xen-blkback

xen/blkback: add missing MODULE_DESCRIPTION() macro

2024-07-10 00:21:18 -06:00

zram

zram: fix potential UAF of zram table

2025-01-12 19:03:37 -08:00

amiflop.c

Merge branch 'for-6.11/block-limits' into for-6.11/block

2024-06-19 08:14:49 -06:00

ataflop.c

Merge branch 'for-6.11/block-limits' into for-6.11/block

2024-06-19 08:14:49 -06:00

brd.c

brd: decrease the number of allocated pages which discarded

2024-11-29 08:43:52 -07:00

floppy.c

floppy: add missing MODULE_DESCRIPTION() macro

2024-07-10 00:22:03 -06:00

Kconfig

reiserfs: The last commit

2024-10-21 16:29:38 +02:00

loop.c

loop: Fix ABBA locking race

2024-11-19 07:54:56 -07:00

Makefile

rust: block: add rnull, Rust null_blk implementation

2024-06-14 07:45:04 -06:00

n64cart.c

block: move the nonrot flag to queue_limits

2024-06-19 07:58:28 -06:00

nbd.c

nbd: don't allow reconnect after disconnect

2025-02-08 10:00:54 +01:00

pktcdvd.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

ps3disk.c

ps3disk: Do not use dev->bounce_size before it is set

2025-02-08 10:00:54 +01:00

ps3vram.c

block: pass a queue_limits argument to blk_alloc_disk

2024-02-19 16:58:23 -07:00

rbd_types.h

…

rbd.c

rbd: unfreeze queue after marking disk as dead

2024-11-07 16:27:22 -07:00

rnull.rs

block: rnull: add missing MODULE_DESCRIPTION

2024-12-03 06:34:11 -07:00

sunvdc.c

block: move the nonrot flag to queue_limits

2024-06-19 07:58:28 -06:00

swim3.c

block: move the nonrot flag to queue_limits

2024-06-19 07:58:28 -06:00

swim_asm.S

…

swim.c

Get rid of 'remove_new' relic from platform driver struct

2024-12-01 15:12:43 -08:00

ublk_drv.c

ublk: fix handling recovery & reissue in ublk_abort_queue()

2025-04-20 10:17:29 +02:00

virtio_blk.c

block: change blk_mq_add_to_batch() third argument type to bool

2025-03-22 12:56:57 -07:00

xen-blkfront.c

xen-blkfront: fix sector_size propagation to the block layer

2024-07-02 08:58:12 -06:00

z2ram.c

z2ram: add missing MODULE_DESCRIPTION() macro

2024-06-19 07:54:00 -06:00