Skip to content
  • Douglas Anderson's avatar
    block, bfq: NULL out the bic when it's no longer valid · 340a4da3
    Douglas Anderson authored
    commit dbc3117d upstream.
    
    In reboot tests on several devices we were seeing a "use after free"
    when slub_debug or KASAN was enabled.  The kernel complained about:
    
      Unable to handle kernel paging request at virtual address 6b6b6c2b
    
    ...which is a classic sign of use after free under slub_debug.  The
    stack crawl in kgdb looked like:
    
     0  test_bit (addr=<optimized out>, nr=<optimized out>)
     1  bfq_bfqq_busy (bfqq=<optimized out>)
     2  bfq_select_queue (bfqd=<optimized out>)
     3  __bfq_dispatch_request (hctx=<optimized out>)
     4  bfq_dispatch_request (hctx=<optimized out>)
     5  0xc056ef00 in blk_mq_do_dispatch_sched (hctx=0xed249440)
     6  0xc056f728 in blk_mq_sched_dispatch_requests (hctx=0xed249440)
     7  0xc0568d24 in __blk_mq_run_hw_queue (hctx=0xed249440)
     8  0xc0568d94 in blk_mq_run_work_fn (work=<optimized out>)
     9  0xc024c5c4 in process_one_work (worker=0xec6d4640, work=0xed249480)
     10 0xc024cff4 in worker_thread (__work...
    340a4da3