Re: [PATCH 2/6] scsi: sr: release CDDA request before copying to userspace
From: Bart Van Assche
Date: Mon Oct 19 2026 - 16:33:41 EST
On 10/18/26 8:41 AM, Wang Yingjie wrote:
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index c36c54ecd354..de43d6e56479 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -968,8 +968,11 @@ static int sr_read_cdda_bpc(struct cdrom_device_info *cdi, void __user *ubuf,
ret = -EIO;
}
+ blk_mq_free_request(rq);
if (blk_rq_unmap_user(bio))
ret = -EFAULT;
+ return ret;
+
out_put_request:
blk_mq_free_request(rq);
return ret;
This change triggers a use-after-free because blk_mq_free_request() calls bio_put(), isn't it?
Bart.