linux/block
zhengbin 40cdc71e11 blk-mq: move cancel of requeue_work to the front of blk_exit_queue
[ Upstream commit e26cc08265 ]

blk_exit_queue will free elevator_data, while blk_mq_requeue_work
will access it. Move cancel of requeue_work to the front of
blk_exit_queue to avoid use-after-free.

blk_exit_queue                blk_mq_requeue_work
  __elevator_exit               blk_mq_run_hw_queues
    blk_mq_exit_sched             blk_mq_run_hw_queue
      dd_exit_queue                 blk_mq_hctx_has_pending
        kfree(elevator_data)          blk_mq_sched_has_work
                                        dd_has_work

Fixes: fbc2a15e34 ("blk-mq: move cancel of requeue_work into blk_mq_release")
Cc: stable@vger.kernel.org
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: zhengbin <zhengbin13@huawei.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-10-01 08:26:10 +02:00
..
partitions
badblocks.c
bfq-cgroup.c
bfq-iosched.c block, bfq: handle NULL return value by bfq_init_rq() 2019-08-29 08:28:46 +02:00
bfq-iosched.h block, bfq: fix in-service-queue check for queue merging 2019-04-05 22:33:12 +02:00
bfq-wf2q.c
bio-integrity.c block/bio-integrity: fix a memory leak bug 2019-07-31 07:27:08 +02:00
bio.c block: do not leak memory in bio_copy_user_iov() 2019-04-17 08:38:51 +02:00
blk-cgroup.c blkcg: update blkcg_print_stat() to handle larger outputs 2019-07-26 09:14:30 +02:00
blk-core.c blk-mq: change gfp flags to GFP_NOIO in blk_mq_realloc_hw_ctxs 2019-10-01 08:26:10 +02:00
blk-exec.c
blk-flush.c blk-mq: change gfp flags to GFP_NOIO in blk_mq_realloc_hw_ctxs 2019-10-01 08:26:10 +02:00
blk-integrity.c
blk-ioc.c
blk-iolatency.c blk-iolatency: fix STS_AGAIN handling 2019-09-16 08:21:41 +02:00
blk-lib.c
blk-map.c
blk-merge.c
blk-mq-cpumap.c
blk-mq-debugfs-zoned.c
blk-mq-debugfs.c block, scsi: Change the preempt-only flag into a counter 2019-08-04 09:30:57 +02:00
blk-mq-debugfs.h
blk-mq-pci.c
blk-mq-rdma.c
blk-mq-sched.c
blk-mq-sched.h
blk-mq-sysfs.c blk-mq: free hw queue's resource in hctx's release handler 2019-09-16 08:22:13 +02:00
blk-mq-tag.c
blk-mq-tag.h
blk-mq-virtio.c
blk-mq.c blk-mq: move cancel of requeue_work to the front of blk_exit_queue 2019-10-01 08:26:10 +02:00
blk-mq.h blk-mq: free hw queue's resource in hctx's release handler 2019-09-16 08:22:13 +02:00
blk-rq-qos.c
blk-rq-qos.h
blk-settings.c
blk-softirq.c
blk-stat.c
blk-stat.h
blk-sysfs.c blk-mq: move cancel of requeue_work to the front of blk_exit_queue 2019-10-01 08:26:10 +02:00
blk-tag.c
blk-throttle.c blk-throttle: fix zero wait time for iops throttled group 2019-07-26 09:14:30 +02:00
blk-timeout.c
blk-wbt.c
blk-wbt.h
blk-zoned.c
blk.h blk-mq: change gfp flags to GFP_NOIO in blk_mq_realloc_hw_ctxs 2019-10-01 08:26:10 +02:00
bounce.c
bsg-lib.c
bsg.c
cfq-iosched.c
cmdline-parser.c
compat_ioctl.c
deadline-iosched.c
elevator.c
genhd.c block: fix use-after-free on gendisk 2019-05-31 06:46:18 -07:00
ioctl.c
ioprio.c
Kconfig
Kconfig.iosched
kyber-iosched.c
Makefile
mq-deadline.c
noop-iosched.c
opal_proto.h
partition-generic.c block: fix use-after-free on gendisk 2019-05-31 06:46:18 -07:00
scsi_ioctl.c
sed-opal.c block: sed-opal: fix IOC_OPAL_ENABLE_DISABLE_MBR 2019-05-31 06:46:24 -07:00
t10-pi.c