summaryrefslogtreecommitdiffstats
path: root/block
diff options
context:
space:
mode:
authorJens Axboe <axboe@kernel.dk>2018-04-17 17:08:52 -0600
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-05-01 12:58:19 -0700
commitbe10336a907253a6066d802c11b6edaf7cf397f8 (patch)
treeea3d3d47084bb891cd84a0de7a10af73ae42044a /block
parentb23b4174275d397281023703ce19ff793e6dfd98 (diff)
downloadlinux-stable-be10336a907253a6066d802c11b6edaf7cf397f8.tar.gz
linux-stable-be10336a907253a6066d802c11b6edaf7cf397f8.tar.bz2
linux-stable-be10336a907253a6066d802c11b6edaf7cf397f8.zip
bfq-iosched: ensure to clear bic/bfqq pointers when preparing request
commit 72961c4e6082be79825265d9193272b8a1634dec upstream. Even if we don't have an IO context attached to a request, we still need to clear the priv[0..1] pointers, as they could be pointing to previously used bic/bfqq structures. If we don't do so, we'll either corrupt memory on dispatching a request, or cause an imbalance in counters. Inspired by a fix from Kees. Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name> Reported-by: Kees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org Fixes: aee69d78dec0 ("block, bfq: introduce the BFQ-v0 I/O scheduler as an extra scheduler") Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'block')
-rw-r--r--block/bfq-iosched.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 0f860cf0d56d..56c9cd01fd1d 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -4447,8 +4447,16 @@ static void bfq_prepare_request(struct request *rq, struct bio *bio)
bool new_queue = false;
bool bfqq_already_existing = false, split = false;
- if (!rq->elv.icq)
+ /*
+ * Even if we don't have an icq attached, we should still clear
+ * the scheduler pointers, as they might point to previously
+ * allocated bic/bfqq structs.
+ */
+ if (!rq->elv.icq) {
+ rq->elv.priv[0] = rq->elv.priv[1] = NULL;
return;
+ }
+
bic = icq_to_bic(rq->elv.icq);
spin_lock_irq(&bfqd->lock);