tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

null_blk: mem garbage on NUMA systems during init

For NUMA systems, initializing the blk-mq layer and using per node hctx.
We initialize submit queues to 1, while blk-mq nr_hw_queues is
initialized to the number of NUMA nodes.

This makes the null_init_hctx function overwrite memory outside of what
it allocated. In my case it lead to writing garbage into struct
request_queue's mq_map.

Signed-off-by: Matias Bjorling <m@bjorling.me>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Matias Bjorling and committed by
Linus Torvalds 57053d8c e4158f1b

+4 -4
+4 -4
drivers/block/null_blk.c
··· 495 495 496 496 spin_lock_init(&nullb->lock); 497 497 498 + if (queue_mode == NULL_Q_MQ && use_per_node_hctx) 499 + submit_queues = nr_online_nodes; 500 + 498 501 if (setup_queues(nullb)) 499 502 goto err; 500 503 501 504 if (queue_mode == NULL_Q_MQ) { 502 505 null_mq_reg.numa_node = home_node; 503 506 null_mq_reg.queue_depth = hw_queue_depth; 507 + null_mq_reg.nr_hw_queues = submit_queues; 504 508 505 509 if (use_per_node_hctx) { 506 510 null_mq_reg.ops->alloc_hctx = null_alloc_hctx; 507 511 null_mq_reg.ops->free_hctx = null_free_hctx; 508 - 509 - null_mq_reg.nr_hw_queues = nr_online_nodes; 510 512 } else { 511 513 null_mq_reg.ops->alloc_hctx = blk_mq_alloc_single_hw_queue; 512 514 null_mq_reg.ops->free_hctx = blk_mq_free_single_hw_queue; 513 - 514 - null_mq_reg.nr_hw_queues = submit_queues; 515 515 } 516 516 517 517 nullb->q = blk_mq_init_queue(&null_mq_reg, nullb);