Re: [PATCH] blkcg: Fix use-after-free of q->root_blkg and q->root_rl.blkg

2012-10-22 Thread Jens Axboe
On 2012-10-17 10:45, Jun'ichi Nomura wrote: > blk_put_rl() does not call blkg_put() for q->root_rl because we > don't take request list reference on q->root_blkg. > However, if root_blkg is once attached then detached (freed), > blk_put_rl() is confused by the bogus pointer in q->root_blkg. > >

Re: [PATCH] blkcg: Fix use-after-free of q-root_blkg and q-root_rl.blkg

2012-10-22 Thread Jens Axboe
On 2012-10-17 10:45, Jun'ichi Nomura wrote: blk_put_rl() does not call blkg_put() for q-root_rl because we don't take request list reference on q-root_blkg. However, if root_blkg is once attached then detached (freed), blk_put_rl() is confused by the bogus pointer in q-root_blkg. For

Re: [PATCH] blkcg: Fix use-after-free of q->root_blkg and q->root_rl.blkg

2012-10-18 Thread Tejun Heo
On Wed, Oct 17, 2012 at 05:45:36PM +0900, Jun'ichi Nomura wrote: > blk_put_rl() does not call blkg_put() for q->root_rl because we > don't take request list reference on q->root_blkg. > However, if root_blkg is once attached then detached (freed), > blk_put_rl() is confused by the bogus pointer in

Re: [PATCH] blkcg: Fix use-after-free of q-root_blkg and q-root_rl.blkg

2012-10-18 Thread Tejun Heo
On Wed, Oct 17, 2012 at 05:45:36PM +0900, Jun'ichi Nomura wrote: blk_put_rl() does not call blkg_put() for q-root_rl because we don't take request list reference on q-root_blkg. However, if root_blkg is once attached then detached (freed), blk_put_rl() is confused by the bogus pointer in

[PATCH] blkcg: Fix use-after-free of q->root_blkg and q->root_rl.blkg

2012-10-17 Thread Jun'ichi Nomura
blk_put_rl() does not call blkg_put() for q->root_rl because we don't take request list reference on q->root_blkg. However, if root_blkg is once attached then detached (freed), blk_put_rl() is confused by the bogus pointer in q->root_blkg. For example, with !CONFIG_BLK_DEV_THROTTLING &&

[PATCH] blkcg: Fix use-after-free of q-root_blkg and q-root_rl.blkg

2012-10-17 Thread Jun'ichi Nomura
blk_put_rl() does not call blkg_put() for q-root_rl because we don't take request list reference on q-root_blkg. However, if root_blkg is once attached then detached (freed), blk_put_rl() is confused by the bogus pointer in q-root_blkg. For example, with !CONFIG_BLK_DEV_THROTTLING