Jens Axboe 61febef40b dm-rq: don't dereference request payload after ending request ...

Bart reported a case where dm would crash with use-after-free
poison. This is due to dm_softirq_done() accessing memory
associated with a request after calling end_request on it.
This is most visible on !blk-mq, since we free the memory
immediately for that case.

Reported-by: Bart Van Assche <bart.vanassche@sandisk.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Fixes: eb8db831be80 ("dm: always defer request allocation to the owner of the request_queue")
Signed-off-by: Jens Axboe <axboe@fb.com>

2017-02-24 13:19:32 -07:00

..

bcache

block: Use pointer to backing_dev_info from request_queue

2017-02-02 08:20:48 -07:00

persistent-data

sched/core: Remove set_task_state()

2017-01-14 11:14:16 +01:00

bitmap.c

md: separate flags for superblock changes

2016-12-08 22:01:47 -08:00

bitmap.h

md-cluster: sync bitmap when node received RESYNCING msg

2016-05-04 12:39:35 -07:00

dm-bio-prison.c

block: add a bi_error field to struct bio

2015-07-29 08:55:15 -06:00

dm-bio-prison.h

dm bio prison: add dm_cell_promote_or_release()

2015-05-29 14:19:06 -04:00

dm-bio-record.h

…

dm-bufio.c

sched/core: Remove set_task_state()

2017-01-14 11:14:16 +01:00

dm-bufio.h

…

dm-builtin.c

dm: move request-based code out to dm-rq.[hc]

2016-06-10 15:15:44 -04:00

dm-cache-block-types.h

linux: drop __bitwise__ everywhere

2016-12-16 00:13:41 +02:00

dm-cache-metadata.c

dm cache metadata: remove an extra newline in DMERR and code

2016-11-21 09:52:02 -05:00

dm-cache-metadata.h

dm cache: make sure every metadata function checks fail_io

2016-03-10 17:12:12 -05:00

dm-cache-policy-cleaner.c

dm cache: speed up writing of the hint array

2016-09-22 11:15:02 -04:00

dm-cache-policy-internal.h

dm cache: speed up writing of the hint array

2016-09-22 11:15:02 -04:00

dm-cache-policy-smq.c

dm cache policy smq: use hash_32() instead of hash_32_generic()

2016-12-08 19:42:37 -05:00

dm-cache-policy.c

…

dm-cache-policy.h

dm cache: speed up writing of the hint array

2016-09-22 11:15:02 -04:00

dm-cache-target.c

block: Use pointer to backing_dev_info from request_queue

2017-02-02 08:20:48 -07:00

dm-core.h

dm: always defer request allocation to the owner of the request_queue

2017-01-27 15:08:35 -07:00

dm-crypt.c

Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-02-20 13:23:30 -08:00

dm-delay.c

dm: rename target's per_bio_data_size to per_io_data_size

2016-02-22 22:34:37 -05:00

dm-era-target.c

block: Use pointer to backing_dev_info from request_queue

2017-02-02 08:20:48 -07:00

dm-exception-store.c

- Revert a dm-multipath change that caused a regression for unprivledged

2015-11-04 21:19:53 -08:00

dm-exception-store.h

dm snapshot: fix hung bios when copy error occurs

2016-01-08 20:03:05 -05:00

dm-flakey.c

dm flakey: introduce "error_writes" feature

2016-12-13 15:01:31 -05:00

dm-io.c

dm io: use bvec iterator helpers to implement .get_page and .next_page

2016-11-21 09:51:57 -05:00

dm-ioctl.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

dm-kcopyd.c

dm: move request-based code out to dm-rq.[hc]

2016-06-10 15:15:44 -04:00

dm-linear.c

libnvdimm for 4.8

2016-07-28 17:38:16 -07:00

dm-log-userspace-base.c

dm: drop NULL test before kmem_cache_destroy() and mempool_destroy()

2015-10-31 19:06:00 -04:00

dm-log-userspace-transfer.c

dm log userspace transfer: match wait_for_completion_timeout return type

2015-04-15 12:10:20 -04:00

dm-log-userspace-transfer.h

…

dm-log-writes.c

Merge branch 'for-4.9/block' of git://git.kernel.dk/linux-block

2016-10-07 14:42:05 -07:00

dm-log.c

block,fs: use REQ_* flags directly

2016-11-01 09:43:26 -06:00

dm-mpath.c

Merge branch 'for-4.11/next' into for-4.11/linus-merge

2017-02-17 14:08:19 -07:00

dm-mpath.h

…

dm-path-selector.c

…

dm-path-selector.h

dm path selector: remove 'repeat_count' return from .select_path hook

2016-02-22 22:34:42 -05:00

dm-queue-length.c

dm path selector: remove 'repeat_count' return from .select_path hook

2016-02-22 22:34:42 -05:00

dm-raid1.c

Merge branch 'for-4.10/block' of git://git.kernel.dk/linux-block

2016-12-13 10:19:16 -08:00

dm-raid.c

. various fixes and improvements to request-based DM and DM multipath

2016-12-14 11:01:00 -08:00

dm-region-hash.c

block: rename bio bi_rw to bi_opf

2016-08-07 14:41:02 -06:00

dm-round-robin.c

dm round robin: do not use this_cpu_ptr() without having preemption disabled

2016-08-15 09:23:14 -04:00

dm-rq.c

dm-rq: don't dereference request payload after ending request

2017-02-24 13:19:32 -07:00

dm-rq.h

dm: always defer request allocation to the owner of the request_queue

2017-01-27 15:08:35 -07:00

dm-service-time.c

dm path selector: remove 'repeat_count' return from .select_path hook

2016-02-22 22:34:42 -05:00

dm-snap-persistent.c

block,fs: use REQ_* flags directly

2016-11-01 09:43:26 -06:00

dm-snap-transient.c

dm snapshot: fix hung bios when copy error occurs

2016-01-08 20:03:05 -05:00

dm-snap.c

block: rename bio bi_rw to bi_opf

2016-08-07 14:41:02 -06:00

dm-stats.c

dm: move request-based code out to dm-rq.[hc]

2016-06-10 15:15:44 -04:00

dm-stats.h

dm stats: support precise timestamps

2015-06-17 12:40:40 -04:00

dm-stripe.c

block: rename bio bi_rw to bi_opf

2016-08-07 14:41:02 -06:00

dm-switch.c

dm switch: simplify conditional in alloc_region_table()

2015-10-31 19:06:06 -04:00

dm-sysfs.c

dm: move request-based code out to dm-rq.[hc]

2016-06-10 15:15:44 -04:00

dm-table.c

block: Use pointer to backing_dev_info from request_queue

2017-02-02 08:20:48 -07:00

dm-target.c

dm: always defer request allocation to the owner of the request_queue

2017-01-27 15:08:35 -07:00

dm-thin-metadata.c

dm thin: fix a race condition between discarding and provisioning a block

2016-07-20 12:43:35 -04:00

dm-thin-metadata.h

dm thin: fix a race condition between discarding and provisioning a block

2016-07-20 12:43:35 -04:00

dm-thin.c

block: Use pointer to backing_dev_info from request_queue

2017-02-02 08:20:48 -07:00

dm-uevent.c

…

dm-uevent.h

…

dm-verity-fec.c

dm verity fec: fix block calculation

2016-07-01 23:29:08 -04:00

dm-verity-fec.h

dm verity: add support for forward error correction

2015-12-10 10:39:03 -05:00

dm-verity-target.c

dm verity: fix incorrect error message

2016-11-21 09:52:01 -05:00

dm-verity.h

dm verity: add ignore_zero_blocks feature

2015-12-10 10:39:03 -05:00

dm-zero.c

block: rename bio bi_rw to bi_opf

2016-08-07 14:41:02 -06:00

dm.c

dm: don't allow ioctls to targets that don't map to whole devices

2017-02-04 10:19:40 -07:00

dm.h

dm: always defer request allocation to the owner of the request_queue

2017-01-27 15:08:35 -07:00

faulty.c

MD: rename some functions

2016-01-20 13:52:20 -08:00

Kconfig

dm block manager: make block locking optional

2016-11-14 15:17:47 -05:00

linear.c

block: Use pointer to backing_dev_info from request_queue

2017-02-02 08:20:48 -07:00

linear.h

…

Makefile

dm: move request-based code out to dm-rq.[hc]

2016-06-10 15:15:44 -04:00

md-cluster.c

md-cluster: make resync lock also could be interruptted

2016-09-21 09:09:44 -07:00

md-cluster.h

md-cluster: gather resync infos and enable recv_thread after bitmap is ready

2016-05-09 09:24:03 -07:00

md.c

Merge branch 'for-4.11/next' into for-4.11/linus-merge

2017-02-17 14:08:19 -07:00

md.h

md: cleanup mddev flag clear for takeover

2017-01-05 11:45:18 -08:00

multipath.c

block: Use pointer to backing_dev_info from request_queue

2017-02-02 08:20:48 -07:00

multipath.h

…

raid0.c

block: Use pointer to backing_dev_info from request_queue

2017-02-02 08:20:48 -07:00

raid0.h

block: kill merge_bvec_fn() completely

2015-08-13 12:31:57 -06:00

raid1.c

block: Use pointer to backing_dev_info from request_queue

2017-02-02 08:20:48 -07:00

raid1.h

md/raid1: add failfast handling for reads.

2016-11-22 09:13:18 -08:00

raid5-cache.c

md/r5cache: disable write back for degraded array

2017-01-24 11:26:06 -08:00

raid5.c

Merge branch 'for-4.11/next' into for-4.11/linus-merge

2017-02-17 14:08:19 -07:00

raid5.h

md/r5cache: disable write back for degraded array

2017-01-24 11:26:06 -08:00

raid10.c

block: Use pointer to backing_dev_info from request_queue

2017-02-02 08:20:48 -07:00

raid10.h

md/raid10: add failfast handling for reads.

2016-11-22 09:14:28 -08:00