Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 74170118 authored by Ming Lei's avatar Ming Lei Committed by Jens Axboe
Browse files

Revert "blk-mq: fix hctx/ctx kobject use-after-free" 

This reverts commit 76d697d1.

The commit 76d697d1 causes general protection fault
reported from Bart Van Assche:

	https://lkml.org/lkml/2015/1/28/334



Reported-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: default avatarMing Lei <ming.lei@canonical.com>
Signed-off-by: default avatarJens Axboe <axboe@fb.com>
parent c59c961c

block/blk-mq-sysfs.c

+2 −23
Original line number Diff line number Diff line
@@ -15,26 +15,6 @@ 


static void blk_mq_sysfs_release(struct kobject *kobj)

{

	struct request_queue *q;



	q = container_of(kobj, struct request_queue, mq_kobj);

	free_percpu(q->queue_ctx);

}



static void blk_mq_ctx_release(struct kobject *kobj)

{

	struct blk_mq_ctx *ctx;



	ctx = container_of(kobj, struct blk_mq_ctx, kobj);

	kobject_put(&ctx->queue->mq_kobj);

}



static void blk_mq_hctx_release(struct kobject *kobj)

{

	struct blk_mq_hw_ctx *hctx;



	hctx = container_of(kobj, struct blk_mq_hw_ctx, kobj);

	kfree(hctx);

}



struct blk_mq_ctx_sysfs_entry {
@@ -338,13 +318,13 @@ static struct kobj_type blk_mq_ktype = { 
static struct kobj_type blk_mq_ctx_ktype = {

	.sysfs_ops	= &blk_mq_sysfs_ops,

	.default_attrs	= default_ctx_attrs,

	.release	= blk_mq_ctx_release,

	.release	= blk_mq_sysfs_release,

};



static struct kobj_type blk_mq_hw_ktype = {

	.sysfs_ops	= &blk_mq_hw_sysfs_ops,

	.default_attrs	= default_hw_ctx_attrs,

	.release	= blk_mq_hctx_release,

	.release	= blk_mq_sysfs_release,

};



static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
@@ -375,7 +355,6 @@ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) 
		return ret;



	hctx_for_each_ctx(hctx, ctx, i) {

		kobject_get(&q->mq_kobj);

		ret = kobject_add(&ctx->kobj, &hctx->kobj, "cpu%u", ctx->cpu);

		if (ret)

			break;

block/blk-mq.c

+5 −1
Original line number Diff line number Diff line
@@ -1641,8 +1641,10 @@ static void blk_mq_free_hw_queues(struct request_queue *q, 
	struct blk_mq_hw_ctx *hctx;

	unsigned int i;



	queue_for_each_hw_ctx(q, hctx, i)

	queue_for_each_hw_ctx(q, hctx, i) {

		free_cpumask_var(hctx->cpumask);

		kfree(hctx);

	}

}



static int blk_mq_init_hctx(struct request_queue *q,
@@ -2000,9 +2002,11 @@ void blk_mq_free_queue(struct request_queue *q) 


	percpu_ref_exit(&q->mq_usage_counter);



	free_percpu(q->queue_ctx);

	kfree(q->queue_hw_ctx);

	kfree(q->mq_map);



	q->queue_ctx = NULL;

	q->queue_hw_ctx = NULL;

	q->mq_map = NULL;