diff options
| author |   Ming Lin <ming.l@samsung.com> | 2016-05-25 23:23:27 -0700 |
|---|---|---|
| committer |   Jens Axboe <axboe@fb.com> | 2016-05-26 08:51:43 -0600 |
| commit | c7de5726307620711a4753b2a13d9e5daecc1081 (patch) | |
| tree | cbc8b1c52c7afc1e6f77490956b514aab95f1a2e /block | |
| parent | MAINTAINERS: mark bcache as orphan (diff) | |
| download | linux-dev-c7de5726307620711a4753b2a13d9e5daecc1081.tar.xz linux-dev-c7de5726307620711a4753b2a13d9e5daecc1081.zip | |
blk-mq: clear q->mq_ops if init fail
blk_mq_init_queue() calls blk_mq_init_allocated_queue(), but q->mq_ops
was not cleared when blk_mq_init_allocated_queue() fails.
Then blk_cleanup_queue() calls blk_mq_free_queue() which will crash because:
- q->all_q_node is not added to all_q_list yet
- q->tag_set is NULL
- hctx was not setup yet or already freed
Fixed it by clearing q->mq_ops on error path.
Signed-off-by: Ming Lin <ming.l@samsung.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
Diffstat (limited to 'block')
| -rw-r--r-- | block/blk-mq.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/block/blk-mq.c b/block/blk-mq.c index 7df9c9263b21..29cbc1b5fbdb 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2020,7 +2020,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set, q->queue_ctx = alloc_percpu(struct blk_mq_ctx); if (!q->queue_ctx) - return ERR_PTR(-ENOMEM); + goto err_exit; q->queue_hw_ctx = kzalloc_node(nr_cpu_ids * sizeof(*(q->queue_hw_ctx)), GFP_KERNEL, set->numa_node); @@ -2084,6 +2084,8 @@ err_map: kfree(q->queue_hw_ctx); err_percpu: free_percpu(q->queue_ctx); +err_exit: + q->mq_ops = NULL; return ERR_PTR(-ENOMEM); } EXPORT_SYMBOL(blk_mq_init_allocated_queue); |