Commit f7700a44 authored by Ming Lei's avatar Ming Lei Committed by Jens Axboe
Browse files

ublk: fix use-after-free in ublk_cancel_cmd() 



When ublk_reset_ch_dev() clears io->cmd via ublk_queue_reinit()
concurrently with ublk_cancel_cmd(), ublk_cancel_cmd() can read a
stale pointer and pass it to io_uring_cmd_done(), causing a
use-after-free.

Fix by synchronizing the two paths with ubq->cancel_lock:

- ublk_cancel_cmd(): read and clear io->cmd under cancel_lock,
  then call io_uring_cmd_done() on the saved local copy outside
  the lock.

- ublk_reset_ch_dev(): hold cancel_lock across ublk_queue_reinit()
  so that io->cmd and io->flags are cleared atomically with respect
  to ublk_cancel_cmd().

Fixes: 216c8f5e ("ublk: replace monitor with cancelable uring_cmd")
Signed-off-by: default avatarMing Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20260508123746.242018-1-tom.leiming@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 86f33ca9

drivers/block/ublk_drv.c

+15 −5
Original line number Diff line number Diff line
@@ -2411,8 +2411,14 @@ static void ublk_reset_ch_dev(struct ublk_device *ub) 
{

	int i;



	for (i = 0; i < ub->dev_info.nr_hw_queues; i++)

		ublk_queue_reinit(ub, ublk_get_queue(ub, i));

	for (i = 0; i < ub->dev_info.nr_hw_queues; i++) {

		struct ublk_queue *ubq = ublk_get_queue(ub, i);



		/* Sync with ublk_cancel_cmd() */

		spin_lock(&ubq->cancel_lock);

		ublk_queue_reinit(ub, ubq);

		spin_unlock(&ubq->cancel_lock);

	}



	/* set to NULL, otherwise new tasks cannot mmap io_cmd_buf */

	ub->mm = NULL;
@@ -2753,6 +2759,7 @@ static void ublk_cancel_cmd(struct ublk_queue *ubq, unsigned tag, 
{

	struct ublk_io *io = &ubq->ios[tag];

	struct ublk_device *ub = ubq->dev;

	struct io_uring_cmd *cmd = NULL;

	struct request *req;

	bool done;
@@ -2775,12 +2782,15 @@ static void ublk_cancel_cmd(struct ublk_queue *ubq, unsigned tag, 


	spin_lock(&ubq->cancel_lock);

	done = !!(io->flags & UBLK_IO_FLAG_CANCELED);

	if (!done)

	if (!done) {

		io->flags |= UBLK_IO_FLAG_CANCELED;

		cmd = io->cmd;

		io->cmd = NULL;

	}

	spin_unlock(&ubq->cancel_lock);



	if (!done)

		io_uring_cmd_done(io->cmd, UBLK_IO_RES_ABORT, issue_flags);

	if (!done && cmd)

		io_uring_cmd_done(cmd, UBLK_IO_RES_ABORT, issue_flags);

}



/*