Re: [PATCH v2] md/raid5-ppl: fix use-after-free in ppl_do_flush()

[yu kuai]

在 2026/6/22 22:06, Sajal Gupta 写道:

> The loop in ppl_do_flush() continues iterating after calling
> ppl_io_unit_finished(), touching io->pending_flushes and leading to a
> use-after-free.
>
> Add a break statement to stop the loop once io is freed.
>
> Fixes: 1532d9e87e8b ("raid5-ppl: PPL support for disks with write-back cache enabled")
> Reported-by: Dan Carpenter<error27@xxxxxxxxx>
> Closes:https://lore.kernel.org/all/ajJF2wKYWRk4GGCK@stanley.mountain/
> Signed-off-by: Sajal Gupta<sajal2005gupta@xxxxxxxxx>
> ---
> Compile tested only.
>
> Changes in v2:
>   - drop the refcount_t conversion
>
> v1:https://lore.kernel.org/all/20260622080656.22786-1-sajal2005gupta@xxxxxxxxx/
>
>   drivers/md/raid5-ppl.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)

Looks correct.

Reviewed-by: Yu Kuai <yukuai@xxxxxxx>

-- 
Thanks,
Kuai