Repository navigation
blk-mq: fix out-of-bounds read in blk_mq_free_rqs - #1283
Open
blktests-ci-kpd[bot] wants to merge 1 commit into
Open
blktests-ci-kpd[bot] wants to merge 1 commit into
blktests-ci-kpd[bot] wants to merge 1 commit into
Conversation
Author
|
Upstream branch: 50d05c7 |
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
September 12, 2026 02:26
7efd8cd to
a0aeca9
Compare
Author
|
Upstream branch: 5225b8e |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
September 12, 2026 02:41
b825b3b to
933f964
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
September 13, 2026 08:50
a0aeca9 to
772381e
Compare
Author
|
Upstream branch: 2f0c1cf |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
September 13, 2026 10:09
933f964 to
a9c93ca
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
September 13, 2026 22:56
772381e to
0224dee
Compare
Author
|
Upstream branch: 2f0c1cf |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
September 13, 2026 23:11
a9c93ca to
0ebb93c
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
September 15, 2026 09:28
0224dee to
f14340f
Compare
Author
|
Upstream branch: 5878583 |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
September 15, 2026 09:46
0ebb93c to
c0f8db6
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
September 17, 2026 19:27
f14340f to
0e174bc
Compare
Author
|
Upstream branch: 4982d35 |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
September 17, 2026 19:48
c0f8db6 to
6510c44
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
September 18, 2026 13:22
0e174bc to
fbef20f
Compare
Author
|
Upstream branch: 5dd1818 |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
September 18, 2026 13:41
6510c44 to
9e81277
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
September 20, 2026 20:45
fbef20f to
4a650fc
Compare
Author
|
Upstream branch: 6a5719c |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
September 20, 2026 21:04
9e81277 to
3b0cfe2
Compare
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
September 26, 2026 08:30
9182022 to
7171e5a
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
September 28, 2026 14:39
372fcdc to
c6537fe
Compare
Author
|
Upstream branch: 72d3fcf |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
September 28, 2026 15:22
7171e5a to
0a1d7da
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
October 1, 2026 15:18
c6537fe to
eebb5bc
Compare
Author
|
Upstream branch: 551c722 |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
2 times, most recently
from
October 1, 2026 16:13
0a1d7da to
feba688
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
October 1, 2026 23:18
eebb5bc to
bbd3af0
Compare
Author
|
Upstream branch: ce1e022 |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
October 1, 2026 23:52
feba688 to
5bd65da
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
October 3, 2026 09:37
bbd3af0 to
a9c0b46
Compare
Author
|
Upstream branch: e767a4e |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
October 3, 2026 10:15
5bd65da to
0c0b777
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
October 3, 2026 21:50
a9c0b46 to
72d0f5e
Compare
Author
|
Upstream branch: a74306e |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
October 3, 2026 22:24
0c0b777 to
6deec4b
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
October 5, 2026 02:03
72d0f5e to
d980ad5
Compare
Author
|
Upstream branch: None |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
October 5, 2026 02:32
6deec4b to
9a34d97
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
October 6, 2026 12:35
d980ad5 to
83b99cc
Compare
Author
|
Upstream branch: 22430ae |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
October 6, 2026 13:16
9a34d97 to
fff1779
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
October 6, 2026 16:58
83b99cc to
9081535
Compare
Author
|
Upstream branch: 69f80fe |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
October 6, 2026 17:29
fff1779 to
25d18ae
Compare
blktests-ci-kpd
Bot
force-pushed
the
linus-master_base
branch
from
October 7, 2026 15:18
9081535 to
6118c5c
Compare
A KASAN slab-out-of-bounds read can occur in blk_mq_free_rqs() when there is a mismatch between the number of hardware queues allocated for the IO scheduler (et->nr_hw_queues) and the number of hardware queues in the block tag set (set->nr_hw_queues). This mismatch can happen if blk_mq_update_nr_hw_queues() fails halfway through (e.g., due to memory pressure during blk_mq_prealloc_tag_set_tags()). In this error path, the elevator is restored with a larger number of hardware queues than the block tag set actually has. When the elevator is later freed, blk_mq_free_sched_tags() iterates up to the new et->nr_hw_queues and calls blk_mq_free_rqs(). In blk_mq_free_rqs(), it attempts to access set->tags[hctx_idx] to get the driver tags. Because set->nr_hw_queues was not updated due to the earlier failure, set->tags still has the old (smaller) size, leading to an out-of-bounds read. BUG: KASAN: slab-out-of-bounds in blk_mq_free_rqs+0xde/0x680 Read of size 8 at addr ffff88818d67fc28 by task syz-executor117/5839 Call Trace: blk_mq_free_rqs+0xde/0x680 blk_mq_free_map_and_rqs+0x40/0xf0 blk_mq_free_sched_tags blk_mq_free_sched_res+0xeb/0x280 elevator_change_done+0x1d2/0x5c0 elevator_change+0x34f/0x480 elv_iosched_store+0x504/0x630 queue_attr_store+0x207/0x2b0 To fix this, explicitly check if hctx_idx < set->nr_hw_queues before accessing set->tags[hctx_idx]. If hctx_idx >= set->nr_hw_queues, the hardware queue doesn't exist in the tag set, meaning there are no driver tags to clear mappings from. In this case, safely set drv_tags to NULL. The subsequent call to blk_mq_clear_rq_mapping() already handles a NULL drv_tags pointer and will safely return. This fix also prevents a similar out-of-bounds read in the failure path of blk_mq_alloc_rqs(), where a failure during new driver tag allocation could lead to blk_mq_free_rqs() being called with an hctx_idx greater than or equal to set->nr_hw_queues. Fixes: 04225d1 ("block: fix potential deadlock while running nr_hw_queue update") Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot Reported-by: syzbot+e90526cab23b9efcd03c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e90526cab23b9efcd03c Link: https://syzkaller.appspot.com/ai_job?id=827b5760-86a0-4f44-9c69-430b572eac12 Signed-off-by: Krystian Kaniewski <krystianmkaniewski@gmail.com> Reviewed-by: Nilay Shorff <nilay@linux.ibm.com>
Author
|
Upstream branch: 7b63ef2 |
blktests-ci-kpd
Bot
force-pushed
the
series/1161970=>linus-master
branch
from
October 7, 2026 16:16
25d18ae to
61a71a6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request for series with
subject: blk-mq: fix out-of-bounds read in blk_mq_free_rqs
version: 1
url: https://patchwork.kernel.org/series/1161970/