From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752900AbbCMJai (ORCPT ); Fri, 13 Mar 2015 05:30:38 -0400 Received: from mail-pd0-f181.google.com ([209.85.192.181]:40426 "EHLO mail-pd0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751933AbbCMJae (ORCPT ); Fri, 13 Mar 2015 05:30:34 -0400 From: Sergey Senozhatsky To: Mike Snitzer , Ming Lei Cc: Jens Axboe , linux-kernel@vger.kernel.org, Sergey Senozhatsky , Sergey Senozhatsky Subject: [PATCH] block: fully initialize queue in blk_mq_init_allocated_queue Date: Fri, 13 Mar 2015 18:30:50 +0900 Message-Id: <1426239050-2528-1-git-send-email-sergey.senozhatsky@gmail.com> X-Mailer: git-send-email 2.3.2.223.g7a9409c Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit c9e8c91f8a279b87eb0d94b037504ea9fc1bef7c Author: Mike Snitzer Date: Tue Mar 10 15:54:41 2015 -0400 blk-mq: fix use of incorrect goto label in blk_mq_init_queue error path for some reason has moved queue allocation 'q = blk_alloc_queue_node()' after 'percpu_ref_init(&q->mq_usage_counter...)', so we are doing percpu init on something that is not a request_queue. Further commit 716452cd27b145d611e4399e7cc35df6c943686e Author: Mike Snitzer Date: Tue Mar 10 17:20:20 2015 -0400 blk-mq: add blk_mq_init_allocated_queue and export has introduced abother issue. In blk_mq_init_queue() we allocate new request_queue: uninit_q = blk_alloc_queue_node(GFP_KERNEL, set->numa_node); if (!uninit_q) return ERR_PTR(-ENOMEM); and pass `uninit_q' as a 'request_queue *q' parameter to blk_mq_init_allocated_queue(): q = blk_mq_init_allocated_queue(set, uninit_q); blk_mq_init_allocated_queue(), however, firstly use passed `uninit_q' to init its percpu, but then it allocates a new request_queue and returns it back, not being properly initialized: blk_mq_init_allocated_queue(struct blk_mq_tag_set *set, struct request_queue *q) [..] if (percpu_ref_init(&q->mq_usage_counter, blk_mq_usage_counter_release, PERCPU_REF_INIT_ATOMIC, GFP_KERNEL)) goto err_hctxs; q = blk_alloc_queue_node(GFP_KERNEL, set->numa_node); if (!q) goto err_hctxs; [..] return q; Which eventually leads to different problems, including a NULL pointer dereference. Remove blk_alloc_queue_node() from blk_mq_init_allocated_queue() and use supplied request_queue. Signed-off-by: Sergey Senozhatsky --- block/blk-mq.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index b838dfc..59fa239 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -1955,10 +1955,6 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set, PERCPU_REF_INIT_ATOMIC, GFP_KERNEL)) goto err_hctxs; - q = blk_alloc_queue_node(GFP_KERNEL, set->numa_node); - if (!q) - goto err_hctxs; - setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q); blk_queue_rq_timeout(q, 30000); -- 2.3.2.223.g7a9409c