AZL-97694

In the Linux kernel, the following vulnerability has been resolved:

block: stop the timeout timer when releasing a never added disk

diskrelease() undoes blkmqinitallocatedqueue() for a disk whose probe failed before adddisk(), but it only calls blkmqexitqueue(). Nothing there stops q->timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the requestqueue is freed while still linked into a timer wheel bucket.

Commit 6f8191fdf41d ("block: simplify disk shutdown") dropped the blkcleanupqueue() call that used to stop it. __delgendisk() and blkmqdestroyqueue() still do; only the probe failure path lost it.

nvme gets there because nvmeupdatensinfo() submits Report Zones or FDP io-mgmt-recv on ns->queue before the disk is added, so a later failure - a concurrent reset setting NVMECTRLFROZEN, or deviceadddisk() failing - lands in putdisk() with the timer armed:

BUG: KASAN: slab-use-after-free in detachifpending+0x30c/0x340 Write of size 8 at addr ffff888004d71310 by task kworker/u8:2/37 __timerdeletesync+0x156/0x240 kernel/time/timer.c:1621 blksyncqueue+0x22/0x40 block/blk-core.c:222 nvmesyncqueues+0x100/0x150 drivers/nvme/host/core.c:5362 nvmeresetwork+0x138/0x930 drivers/nvme/host/pci.c:3264

Allocated by task 34: _blkmqallocdisk+0x33/0x100 block/blk-mq.c:4462 nvmeallocns+0x290/0x3870 drivers/nvme/host/core.c:4146

Freed by task 0: blkfreequeuercu+0x3a/0x50 block/blk-core.c:254 rcucore+0xc10/0x1730 kernel/rcu/tree.c:2857

The queue being synced there is ctrl->adminq, only a victim sharing a timer wheel bucket with the freed queue's dangling entry; other runs tripped in enqueuetimer(), __runtimers() or blkmqtimeoutwork(). Failing nvmeallocns() with a debug patch makes it deterministic: one leaked timer trips KASAN within seconds, while 1987 patched releases produced no splat.

Stop the timer and the queue work items before blkmqexitqueue(), like blkmqdestroyqueue() does.

Found by FuzzNvme.