block: free q->flush_rq in blk_init_allocated_queue error paths.

block: free q->flush_rq in blk_init_allocated_queue error paths.

[Dave Jones]

Commit 7982e90c3a ("block: fix q->flush_rq NULL pointer crash on dm-mpath flush")
moved an allocation to blk_init_allocated_queue(), but neglected to free
that allocation on the error paths that follow.

Signed-off-by: Dave Jones <davej@fedoraproject.org>

diff --git a/block/blk-core.c b/block/blk-core.c
index 4cd5ffc18442..bfe16d5af9f9 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -713,7 +713,7 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
 		return NULL;
 
 	if (blk_init_rl(&q->root_rl, q, GFP_KERNEL))
-		return NULL;
+		goto fail;
 
 	q->request_fn		= rfn;
 	q->prep_rq_fn		= NULL;
@@ -737,12 +737,16 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
 	/* init elevator */
 	if (elevator_init(q, NULL)) {
 		mutex_unlock(&q->sysfs_lock);
-		return NULL;
+		goto fail;
 	}
 
 	mutex_unlock(&q->sysfs_lock);
 
 	return q;
+
+fail:
+	kfree(q->flush_rq);
+	return NULL;
 }
 EXPORT_SYMBOL(blk_init_allocated_queue);
 

Re: block: free q->flush_rq in blk_init_allocated_queue error paths.

[Mike Snitzer]

On Wed, Mar 19 2014 at  3:12pm -0400,
Dave Jones <davej@redhat.com> wrote:

> Commit 7982e90c3a ("block: fix q->flush_rq NULL pointer crash on dm-mpath flush")
> moved an allocation to blk_init_allocated_queue(), but neglected to free
> that allocation on the error paths that follow.
> 
> Signed-off-by: Dave Jones <davej@fedoraproject.org>

Ngh.. thanks Dave!

/me hangs his head in shame...

Acked-by: Mike Snitzer <snitzer@redhat.com>

Jens, really sorry about this oversight.  I can take it on the chin and
pick this up for Linus to take this week from linux-dm.git.  Your call.

Re: block: free q->flush_rq in blk_init_allocated_queue error paths.

[Jens Axboe]

On 03/19/2014 01:22 PM, Mike Snitzer wrote:
> On Wed, Mar 19 2014 at  3:12pm -0400,
> Dave Jones <davej@redhat.com> wrote:
>
>> Commit 7982e90c3a ("block: fix q->flush_rq NULL pointer crash on dm-mpath flush")
>> moved an allocation to blk_init_allocated_queue(), but neglected to free
>> that allocation on the error paths that follow.
>>
>> Signed-off-by: Dave Jones <davej@fedoraproject.org>
>
> Ngh.. thanks Dave!
>
> /me hangs his head in shame...
>
> Acked-by: Mike Snitzer <snitzer@redhat.com>
>
> Jens, really sorry about this oversight.  I can take it on the chin and
> pick this up for Linus to take this week from linux-dm.git.  Your call.

No worries, I'll shove it off to Linus today. Then I can punch you on 
the chin next week.

-- 
Jens Axboe