From: Omar Sandoval <osandov@osandov.com>
To: Alexander Gordeev <agordeev@redhat.com>
Cc: linux-kernel@vger.kernel.org, linux-block@vger.kernel.org
Subject: Re: [PATCH 09/14] blk-mq: Move duplicating code to blk_mq_exit_hctx()
Date: Mon, 19 Sep 2016 10:57:19 -0700 [thread overview]
Message-ID: <20160919175719.GB21803@vader> (raw)
In-Reply-To: <08fde52dea32101ca7fffe1ff6e1a4786a7eab2c.1474183901.git.agordeev@redhat.com>
On Sun, Sep 18, 2016 at 09:37:19AM +0200, Alexander Gordeev wrote:
> CC: linux-block@vger.kernel.org
> Signed-off-by: Alexander Gordeev <agordeev@redhat.com>
> ---
> block/blk-mq.c | 14 +++++---------
> 1 file changed, 5 insertions(+), 9 deletions(-)
>
> diff --git a/block/blk-mq.c b/block/blk-mq.c
> index 3efb700..cd32a08 100644
> --- a/block/blk-mq.c
> +++ b/block/blk-mq.c
> @@ -1678,6 +1678,10 @@ static void blk_mq_exit_hctx(struct request_queue *q,
> blk_mq_unregister_cpu_notifier(&hctx->cpu_notifier);
> blk_free_flush_queue(hctx->fq);
> blk_mq_free_bitmap(&hctx->ctx_map);
> +
> + free_cpumask_var(hctx->cpumask);
> + kfree(hctx->ctxs);
> + kfree(hctx);
> }
>
> static void blk_mq_exit_hw_queues(struct request_queue *q,
> @@ -1686,12 +1690,8 @@ static void blk_mq_exit_hw_queues(struct request_queue *q,
> struct blk_mq_hw_ctx *hctx;
> unsigned int i;
>
> - queue_for_each_hw_ctx(q, hctx, i) {
> + queue_for_each_hw_ctx(q, hctx, i)
> blk_mq_exit_hctx(q, set, hctx, i);
> - free_cpumask_var(hctx->cpumask);
> - kfree(hctx->ctxs);
> - kfree(hctx);
> - }
>
> q->nr_hw_queues = 0;
> }
> @@ -2018,12 +2018,8 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
> set->tags[j] = NULL;
> }
> blk_mq_exit_hctx(q, set, hctx, j);
> - free_cpumask_var(hctx->cpumask);
> kobject_put(&hctx->kobj);
Now this hctx->kobj will be a use-after-free since we just kfreed hctx
in blk_mq_exit_hctx().
> - kfree(hctx->ctxs);
> - kfree(hctx);
> hctxs[j] = NULL;
> -
> }
> }
> q->nr_hw_queues = i;
> --
> 1.8.3.1
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-block" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Omar
next prev parent reply other threads:[~2016-09-19 18:02 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-18 7:37 [PATCH 00/14] blk-mq: Minor fixes and cleanups Alexander Gordeev
2016-09-18 7:37 ` [PATCH 01/14] blk-mq: Fix memory leaks on queue cleanup Alexander Gordeev
2016-09-19 13:51 ` Christoph Hellwig
2016-09-18 7:37 ` [PATCH 02/14] blk-mq: Fix a potential NULL pointer assignment to hctx tags Alexander Gordeev
2016-09-19 18:34 ` Omar Sandoval
2016-09-18 7:37 ` [PATCH 03/14] block: Get rid of unused request_queue::nr_queues member Alexander Gordeev
2016-09-19 18:37 ` Omar Sandoval
2016-09-18 7:37 ` [PATCH 04/14] blk-mq: Do not limit number of queues to 'nr_cpu_ids' in allocations Alexander Gordeev
2016-09-19 17:48 ` Omar Sandoval
2016-09-20 11:44 ` Alexander Gordeev
2016-09-20 17:26 ` Omar Sandoval
2016-09-18 7:37 ` [PATCH 05/14] blk-mq: Remove a redundant assignment Alexander Gordeev
2016-09-19 18:38 ` Omar Sandoval
2016-09-18 7:37 ` [PATCH 06/14] blk-mq: Fix hardware context data node selection Alexander Gordeev
2016-09-19 18:54 ` Omar Sandoval
2016-09-18 7:37 ` [PATCH 07/14] blk-mq: Cleanup a loop exit condition Alexander Gordeev
2016-09-19 19:00 ` Omar Sandoval
2016-09-20 11:33 ` Alexander Gordeev
2016-09-18 7:37 ` [PATCH 08/14] blk-mq: Get rid of unnecessary blk_mq_free_hw_queues() Alexander Gordeev
2016-09-18 7:37 ` [PATCH 09/14] blk-mq: Move duplicating code to blk_mq_exit_hctx() Alexander Gordeev
2016-09-19 17:57 ` Omar Sandoval [this message]
2016-09-18 7:37 ` [PATCH 10/14] blk-mq: Uninit hardware context in order reverse to init Alexander Gordeev
2016-09-19 17:59 ` Omar Sandoval
2016-09-18 7:37 ` [PATCH 11/14] blk-mq: Move hardware context init code into single location Alexander Gordeev
2016-09-18 7:37 ` [PATCH 12/14] blk-mq: Rework blk_mq_init_hctx() function Alexander Gordeev
2016-09-18 7:37 ` [PATCH 13/14] blk-mq: Pair blk_mq_hctx_kobj_init() with blk_mq_hctx_kobj_put() Alexander Gordeev
2016-09-18 7:37 ` [PATCH 14/14] blk-mq: Set flush_start_tag to BLK_MQ_MAX_DEPTH Alexander Gordeev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160919175719.GB21803@vader \
--to=osandov@osandov.com \
--cc=agordeev@redhat.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox