Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'for-linus' of git://git.kernel.dk/linux-block
Pull two block layer fixes from Jens Axboe:
"Two small patches that should make it into 3.19:
- a fixup from me for NVMe, making the cq_vector a signed variable.
Otherwise our -1 comparison fails, and commit 2b25d981790b doesn't
do what it was supposed to.
- a fixup for the hotplug handling for blk-mq from Ming Lei, using
the proper kobject referencing to ensure we release resources at
the right time"
* 'for-linus' of git://git.kernel.dk/linux-block:
blk-mq: fix hctx/ctx kobject use-after-free
NVMe: cq_vector should be signed
+25
-8
+23
-2
block/blk-mq-sysfs.c
+23
-2
block/blk-mq-sysfs.c
···
15
15
16
16
static void blk_mq_sysfs_release(struct kobject *kobj)
17
17
{
18
+
struct request_queue *q;
19
+
20
+
q = container_of(kobj, struct request_queue, mq_kobj);
21
+
free_percpu(q->queue_ctx);
22
+
}
23
+
24
+
static void blk_mq_ctx_release(struct kobject *kobj)
25
+
{
26
+
struct blk_mq_ctx *ctx;
27
+
28
+
ctx = container_of(kobj, struct blk_mq_ctx, kobj);
29
+
kobject_put(&ctx->queue->mq_kobj);
30
+
}
31
+
32
+
static void blk_mq_hctx_release(struct kobject *kobj)
33
+
{
34
+
struct blk_mq_hw_ctx *hctx;
35
+
36
+
hctx = container_of(kobj, struct blk_mq_hw_ctx, kobj);
37
+
kfree(hctx);
18
38
}
19
39
20
40
struct blk_mq_ctx_sysfs_entry {
···
338
318
static struct kobj_type blk_mq_ctx_ktype = {
339
319
.sysfs_ops = &blk_mq_sysfs_ops,
340
320
.default_attrs = default_ctx_attrs,
341
-
.release = blk_mq_sysfs_release,
321
+
.release = blk_mq_ctx_release,
342
322
};
343
323
344
324
static struct kobj_type blk_mq_hw_ktype = {
345
325
.sysfs_ops = &blk_mq_hw_sysfs_ops,
346
326
.default_attrs = default_hw_ctx_attrs,
347
-
.release = blk_mq_sysfs_release,
327
+
.release = blk_mq_hctx_release,
348
328
};
349
329
350
330
static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
···
375
355
return ret;
376
356
377
357
hctx_for_each_ctx(hctx, ctx, i) {
358
+
kobject_get(&q->mq_kobj);
378
359
ret = kobject_add(&ctx->kobj, &hctx->kobj, "cpu%u", ctx->cpu);
379
360
if (ret)
380
361
break;
+1
-5
block/blk-mq.c
+1
-5
block/blk-mq.c
···
1641
1641
struct blk_mq_hw_ctx *hctx;
1642
1642
unsigned int i;
1643
1643
1644
-
queue_for_each_hw_ctx(q, hctx, i) {
1644
+
queue_for_each_hw_ctx(q, hctx, i)
1645
1645
free_cpumask_var(hctx->cpumask);
1646
-
kfree(hctx);
1647
-
}
1648
1646
}
1649
1647
1650
1648
static int blk_mq_init_hctx(struct request_queue *q,
···
2000
2002
2001
2003
percpu_ref_exit(&q->mq_usage_counter);
2002
2004
2003
-
free_percpu(q->queue_ctx);
2004
2005
kfree(q->queue_hw_ctx);
2005
2006
kfree(q->mq_map);
2006
2007
2007
-
q->queue_ctx = NULL;
2008
2008
q->queue_hw_ctx = NULL;
2009
2009
q->mq_map = NULL;
2010
2010