Re: [PATCH v2] blk-mq: fix out-of-bounds read in blk_mq_free_rqs

[Jens Axboe]

On Wed, 14 Oct 2026 19:05:36 +0200, Krystian Kaniewski wrote:
> A KASAN slab-out-of-bounds read can occur in blk_mq_free_rqs() when there
> is a mismatch between the number of hardware queues allocated for the IO
> scheduler (et->nr_hw_queues) and the number of hardware queues in the block
> tag set (set->nr_hw_queues).
> 
> This mismatch can happen if blk_mq_update_nr_hw_queues() fails halfway
> through (e.g., due to memory pressure during
> blk_mq_prealloc_tag_set_tags()). In this error path, the elevator is
> restored with a larger number of hardware queues than the block tag set
> actually has.
> 
> [...]

Applied, thanks!

[1/1] blk-mq: fix out-of-bounds read in blk_mq_free_rqs
      commit: 894e4e6084924cfd590968d45fad20908e02ddae

Best regards,
-- 
Jens Axboe