Commit ad5f498f authored Oct 27, 2015 by Mikulas Patocka Committed by Mike Snitzer Oct 29, 2015

dm: initialize non-blk-mq queue data before queue is used



Commit bfebd1cd ("dm: add full blk-mq
support to request-based DM") moves the initialization of the fields
backing_dev_info.congested_fn, backing_dev_info.congested_data and
queuedata from the function dm_init_md_queue (that is called when the
device is created) to dm_init_old_md_queue (that is called after the
device type is determined).

There is no locking when accessing these variables, thus it is possible
for other parts of the kernel to briefly see this data in a transient
state (e.g. queue->backing_dev_info.congested_fn initialized and
md->queue->backing_dev_info.congested_data uninitialized, resulting in
passing an incorrect parameter to the function dm_any_congested).

This queue data is left initialized for blk-mq devices even though they
that don't use it.

Fixes: bfebd1cd ("dm: add full blk-mq support to request-based DM")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org # v4.1+

parent a6dd1020

drivers/md/dm.c

+7 −3

Original line number	Diff line number	Diff line
		@@ -2197,6 +2197,13 @@ static void dm_init_md_queue(struct mapped_device *md)
		* This queue is new, so no concurrency on the queue_flags.
		*/
		queue_flag_clear_unlocked(QUEUE_FLAG_STACKABLE, md->queue);

		/*
		* Initialize data that will only be used by a non-blk-mq DM queue
		* - must do so here (in alloc_dev callchain) before queue is used
		*/
		md->queue->queuedata = md;
		md->queue->backing_dev_info.congested_data = md;
		}

		static void dm_init_old_md_queue(struct mapped_device *md)
		@@ -2207,10 +2214,7 @@ static void dm_init_old_md_queue(struct mapped_device *md)
		/*
		* Initialize aspects of queue that aren't relevant for blk-mq
		*/
		md->queue->queuedata = md;
		md->queue->backing_dev_info.congested_fn = dm_any_congested;
		md->queue->backing_dev_info.congested_data = md;

		blk_queue_bounce_limit(md->queue, BLK_BOUNCE_ANY);
		}