blk-mq: clear q->mq_ops if init fail (c7de5726) · Commits · 戴 / test

blk_mq_init_queue() calls blk_mq_init_allocated_queue(), but q->mq_ops was not cleared when blk_mq_init_allocated_queue() fails. Then blk_cleanup_queue() calls blk_mq_free_queue() which will crash because: - q->all_q_node is not added to all_q_list yet - q->tag_set is NULL - hctx was not setup yet or already freed Fixed it by clearing q->mq_ops on error path. Signed-off-by:

Ming Lin <ming.l@samsung.com> Reviewed-by:

Christoph Hellwig <hch@lst.de> Signed-off-by:

Jens Axboe <axboe@fb.com>

block/blk-mq.c

+3 −1

Original line number	Original line	Diff line number	Diff line
	@@ -2020,7 +2020,7 @@ struct request_queue blk_mq_init_allocated_queue(struct blk_mq_tag_set set,

	q->queue_ctx = alloc_percpu(struct blk_mq_ctx);		q->queue_ctx = alloc_percpu(struct blk_mq_ctx);
	if (!q->queue_ctx)		if (!q->queue_ctx)
	return ERR_PTR(-ENOMEM);		goto err_exit;

	q->queue_hw_ctx = kzalloc_node(nr_cpu_ids * sizeof(*(q->queue_hw_ctx)),		q->queue_hw_ctx = kzalloc_node(nr_cpu_ids * sizeof(*(q->queue_hw_ctx)),
	GFP_KERNEL, set->numa_node);		GFP_KERNEL, set->numa_node);
	@@ -2084,6 +2084,8 @@ err_map:
	kfree(q->queue_hw_ctx);		kfree(q->queue_hw_ctx);
	err_percpu:		err_percpu:
	free_percpu(q->queue_ctx);		free_percpu(q->queue_ctx);
			err_exit:
			q->mq_ops = NULL;
	return ERR_PTR(-ENOMEM);		return ERR_PTR(-ENOMEM);
	}		}
	EXPORT_SYMBOL(blk_mq_init_allocated_queue);		EXPORT_SYMBOL(blk_mq_init_allocated_queue);

Admin message