Commit c7de5726 authored May 25, 2016 by Ming Lin Committed by Jens Axboe May 26, 2016

blk-mq: clear q->mq_ops if init fail



blk_mq_init_queue() calls blk_mq_init_allocated_queue(), but q->mq_ops
was not cleared when blk_mq_init_allocated_queue() fails.
Then blk_cleanup_queue() calls blk_mq_free_queue() which will crash because:
- q->all_q_node is not added to all_q_list yet
- q->tag_set is NULL
- hctx was not setup yet or already freed

Fixed it by clearing q->mq_ops on error path.

Signed-off-by: Ming Lin <ming.l@samsung.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>

parent 4d1034eb

block/blk-mq.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -2020,7 +2020,7 @@ struct request_queue blk_mq_init_allocated_queue(struct blk_mq_tag_set set,

		q->queue_ctx = alloc_percpu(struct blk_mq_ctx);
		if (!q->queue_ctx)
		return ERR_PTR(-ENOMEM);
		goto err_exit;

		q->queue_hw_ctx = kzalloc_node(nr_cpu_ids * sizeof(*(q->queue_hw_ctx)),
		GFP_KERNEL, set->numa_node);
		@@ -2084,6 +2084,8 @@ struct request_queue blk_mq_init_allocated_queue(struct blk_mq_tag_set set,
		kfree(q->queue_hw_ctx);
		err_percpu:
		free_percpu(q->queue_ctx);
		err_exit:
		q->mq_ops = NULL;
		return ERR_PTR(-ENOMEM);
		}
		EXPORT_SYMBOL(blk_mq_init_allocated_queue);