redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

Merge branch 'for-linus' of git://git.kernel.dk/linux-block 

Pull final block layer fixes from Jens Axboe:
 "Unfortunately the hctx/ctx lifetime fix from last pull had some
  issues.  This pull request contains a revert of the problematic
  commit, and a proper rewrite of it.

  The rewrite has been tested by the users complaining about the
  regression, and it works fine now.  Additionally, I've run testing on
  all the blk-mq use cases for it and it passes.  So we should
  definitely get this into 3.19, to avoid regression for some cases"

* 'for-linus' of git://git.kernel.dk/linux-block:
  blk-mq: release mq's kobjects in blk_release_queue()
  Revert "blk-mq: fix hctx/ctx kobject use-after-free"
hifive-unleashed-5.1
Linus Torvalds 2015-02-03 11:36:57 -08:00
parent 0dc17d142c e09aae7ede
commit 0f98c38d72
4 changed files with 27 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
block/blk-mq-sysfs.c
View File

@ -15,26 +15,6 @@
static void blk_mq_sysfs_release(struct kobject *kobj)
{
struct request_queue *q;
q = container_of(kobj, struct request_queue, mq_kobj);
free_percpu(q->queue_ctx);
}
static void blk_mq_ctx_release(struct kobject *kobj)
{
struct blk_mq_ctx *ctx;
ctx = container_of(kobj, struct blk_mq_ctx, kobj);
kobject_put(&ctx->queue->mq_kobj);
}
static void blk_mq_hctx_release(struct kobject *kobj)
{
struct blk_mq_hw_ctx *hctx;
hctx = container_of(kobj, struct blk_mq_hw_ctx, kobj);
kfree(hctx);
}
struct blk_mq_ctx_sysfs_entry {
@ -338,13 +318,13 @@ static struct kobj_type blk_mq_ktype = {
static struct kobj_type blk_mq_ctx_ktype = {
.sysfs_ops = &blk_mq_sysfs_ops,
.default_attrs = default_ctx_attrs,
.release = blk_mq_ctx_release,
.release = blk_mq_sysfs_release,
};
static struct kobj_type blk_mq_hw_ktype = {
.sysfs_ops = &blk_mq_hw_sysfs_ops,
.default_attrs = default_hw_ctx_attrs,
.release = blk_mq_hctx_release,
.release = blk_mq_sysfs_release,
};
static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
@ -375,7 +355,6 @@ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
return ret;
hctx_for_each_ctx(hctx, ctx, i) {
kobject_get(&q->mq_kobj);
ret = kobject_add(&ctx->kobj, &hctx->kobj, "cpu%u", ctx->cpu);
if (ret)
break;

23
block/blk-mq.c
View File

@ -1867,6 +1867,27 @@ static void blk_mq_add_queue_tag_set(struct blk_mq_tag_set *set,
mutex_unlock(&set->tag_list_lock);
}
/*
* It is the actual release handler for mq, but we do it from
* request queue's release handler for avoiding use-after-free
* and headache because q->mq_kobj shouldn't have been introduced,
* but we can't group ctx/kctx kobj without it.
*/
void blk_mq_release(struct request_queue *q)
{
struct blk_mq_hw_ctx *hctx;
unsigned int i;
/* hctx kobj stays in hctx */
queue_for_each_hw_ctx(q, hctx, i)
kfree(hctx);
kfree(q->queue_hw_ctx);
/* ctx kobj stays in queue_ctx */
free_percpu(q->queue_ctx);
}
struct request_queue *blk_mq_init_queue(struct blk_mq_tag_set *set)
{
struct blk_mq_hw_ctx **hctxs;
@ -2000,10 +2021,8 @@ void blk_mq_free_queue(struct request_queue *q)
percpu_ref_exit(&q->mq_usage_counter);
kfree(q->queue_hw_ctx);
kfree(q->mq_map);
q->queue_hw_ctx = NULL;
q->mq_map = NULL;
mutex_lock(&all_q_mutex);

2
block/blk-mq.h
View File

@ -62,6 +62,8 @@ extern void blk_mq_sysfs_unregister(struct request_queue *q);
extern void blk_mq_rq_timed_out(struct request *req, bool reserved);
void blk_mq_release(struct request_queue *q);
/*
* Basic implementation of sparser bitmap, allowing the user to spread
* the bits over more cachelines.

2
block/blk-sysfs.c
View File

@ -517,6 +517,8 @@ static void blk_release_queue(struct kobject *kobj)
if (!q->mq_ops)
blk_free_flush_queue(q->fq);
else
blk_mq_release(q);
blk_trace_shutdown(q);