From: Yuanyuan Zhong When a controller is deleted (e.g., via sysfs delete_controller), the admin queue is freed while userspace may still have open fd to the namespace block device. Userspace can issue IOCTLs on the open fd that access the freed admin queue through the stale ns->ctrl->admin_q pointer, causing a use-after-free. Fix this by taking an additional reference on the admin queue during namespace allocation and releasing it during namespace cleanup. Signed-off-by: Casey Chen Signed-off-by: Seamus Connor --- drivers/nvme/host/core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 8d8af58e79d1..184a6096a2be 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -687,6 +687,7 @@ static void nvme_free_ns(struct kref *kref) { struct nvme_ns *ns = container_of(kref, struct nvme_ns, kref); + blk_put_queue(ns->ctrl->admin_q); put_disk(ns->disk); nvme_put_ns_head(ns->head); nvme_put_ctrl(ns->ctrl); @@ -3903,9 +3904,14 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, struct nvme_ns_info *info) struct gendisk *disk; int node = ctrl->numa_node; + if (!blk_get_queue(ctrl->admin_q)) { + dev_err(ctrl->device, "failed to get admin_q %p\n", ctrl->admin_q); + return; + } + ns = kzalloc_node(sizeof(*ns), GFP_KERNEL, node); if (!ns) - return; + goto out_put_admin_q; if (ctrl->opts && ctrl->opts->data_digest) lim.features |= BLK_FEAT_STABLE_WRITES; @@ -4002,6 +4008,8 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, struct nvme_ns_info *info) put_disk(disk); out_free_ns: kfree(ns); + out_put_admin_q: + blk_put_queue(ctrl->admin_q); } static void nvme_ns_remove(struct nvme_ns *ns) -- 2.49.0