Re: [PATCH] ublk: fix null-ptr-deref in ublk_queue_cmd

[Ming Lei]

On Mon, Jun 1, 2026 at 1:55 PM Yun Zhou <yun.zhou@xxxxxxxxxxxxx> wrote:
>
> ublk_queue_cmd() dereferences ios[tag].cmd without NULL check. The cmd
> pointer can be NULL when ublk_cancel_cmd() races with IO dispatch during
> server teardown:
>
>   CPU0 (partition scan work)        CPU1 (io_uring cancel callback)
>   ublk_queue_rq()
>     ublk_prep_req() -> OK
>     check canceling -> false
>                                     ublk_start_cancel()
>                                       quiesce, set canceling, unquiesce
>                                     ublk_cancel_cmd()
>                                       io->cmd = NULL
>     ublk_queue_cmd()
>       cmd = ios[tag].cmd  -> NULL
>       ublk_get_uring_cmd_pdu(cmd) -> null-ptr-deref
>
> The race window exists because ublk_cancel_cmd() can execute between the
> canceling flag check and the cmd dereference in ublk_queue_cmd(). This
> cannot be closed with simple synchronization since blk_mq_quiesce_queue
> only waits for in-flight dispatches, not requests already past the
> canceling check.
>
> Fix by checking cmd for NULL before dereferencing. When NULL, abort the
> request via __ublk_abort_rq() which handles both recovery (requeue) and
> non-recovery (end with IOERR) cases.
>
> Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver")
> Reported-by: syzbot+415b9ec753cd2a196087@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=415b9ec753cd2a196087
> Signed-off-by: Yun Zhou <yun.zhou@xxxxxxxxxxxxx>

Hello Yun,

It should have been addressed by the following commit:

https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git/commit/?h=for-7.2/block&id=1133b93fc7f63defaa2c07d5f49873c14bb74681



Thanks,
Ming Lei