diff options
| author | Jens Axboe <axboe@kernel.dk> | 2018-04-17 17:08:52 -0600 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-05-01 12:47:25 -0700 |
| commit | c9071d6aff3c74cd0f2a2080a69aab296b87c00d (patch) | |
| tree | 4d3ceccc13a24c7519601e9db338432efbbed848 /block | |
| parent | 066d25c39bdd180c32c1700a1d2479bcf0bd8e59 (diff) | |
bfq-iosched: ensure to clear bic/bfqq pointers when preparing request
commit 72961c4e6082be79825265d9193272b8a1634dec upstream.
Even if we don't have an IO context attached to a request, we still
need to clear the priv[0..1] pointers, as they could be pointing
to previously used bic/bfqq structures. If we don't do so, we'll
either corrupt memory on dispatching a request, or cause an
imbalance in counters.
Inspired by a fix from Kees.
Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Reported-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Fixes: aee69d78dec0 ("block, bfq: introduce the BFQ-v0 I/O scheduler as an extra scheduler")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'block')
| -rw-r--r-- | block/bfq-iosched.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index aeca22d91101..3193b2663bed 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -4911,8 +4911,16 @@ static void bfq_prepare_request(struct request *rq, struct bio *bio) bool new_queue = false; bool bfqq_already_existing = false, split = false; - if (!rq->elv.icq) + /* + * Even if we don't have an icq attached, we should still clear + * the scheduler pointers, as they might point to previously + * allocated bic/bfqq structs. + */ + if (!rq->elv.icq) { + rq->elv.priv[0] = rq->elv.priv[1] = NULL; return; + } + bic = icq_to_bic(rq->elv.icq); spin_lock_irq(&bfqd->lock); |