Commit 1cd96c24 authored by Boaz Harrosh's avatar Boaz Harrosh Committed by Jens Axboe
Browse files

block: WARN in __blk_put_request() for potential bio leak 



Put a WARN_ON in __blk_put_request if it is about to
leak bio(s). This is a serious bug that can happen in error
handling code paths.

For this to work I have fixed a couple of places in block/ where
request->bio != NULL ownership was not honored. And a small cleanup
at sg_io() while at it.

Signed-off-by: default avatarBoaz Harrosh <bharrosh@panasas.com>
Signed-off-by: default avatarJens Axboe <jens.axboe@oracle.com>
parent f028f3b2

block/blk-core.c

+3 −0
Original line number Diff line number Diff line
@@ -1062,6 +1062,9 @@ void __blk_put_request(struct request_queue *q, struct request *req) 


	elv_completed_request(q, req);



	/* this is a bio leak */

	WARN_ON(req->bio != NULL);



	/*

	 * Request may not have originated from ll_rw_blk. if not,

	 * it didn't come out of our reserved rq pools

block/blk-merge.c

+2 −0
Original line number Diff line number Diff line
@@ -403,6 +403,8 @@ static int attempt_merge(struct request_queue *q, struct request *req, 
	if (blk_rq_cpu_valid(next))

		req->cpu = next->cpu;



	/* owner-ship of bio passed from next to req */

	next->bio = NULL;

	__blk_put_request(q, next);

	return 1;

}

block/scsi_ioctl.c

+4 −17
Original line number Diff line number Diff line
@@ -214,21 +214,10 @@ static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq, 
	return 0;

}



/*

 * unmap a request that was previously mapped to this sg_io_hdr. handles

 * both sg and non-sg sg_io_hdr.

 */

static int blk_unmap_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr)

{

	blk_rq_unmap_user(rq->bio);

	blk_put_request(rq);

	return 0;

}



static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,

				 struct bio *bio)

{

	int r, ret = 0;

	int ret = 0;



	/*

	 * fill in all the output members
@@ -253,12 +242,10 @@ static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr, 
			ret = -EFAULT;

	}



	rq->bio = bio;

	r = blk_unmap_sghdr_rq(rq, hdr);

	if (ret)

		r = ret;

	blk_rq_unmap_user(bio);

	blk_put_request(rq);



	return r;

	return ret;

}



static int sg_io(struct request_queue *q, struct gendisk *bd_disk,

CRA Git | Maintained and supported by SUSTech CRA and CCSE