On Thu, 14 Aug 2014, Matias Bjorling wrote:
nr_tags must be uninitialized or screwed up somehow, otherwise I don't see how that kmalloc() could warn on being too large. Keith, are you running with slab debugging? Matias, might be worth trying.
The queue's tags were freed in 'blk_mq_map_swqueue' because some queues weren't mapped to a s/w queue, but the driver has a pointer to that freed memory, so it's a use-after-free error. This part in the driver looks different than it used to be in v8 when I last tested. The nvme_queue used to have a pointer to the 'hctx', but now it points directly to the 'tags', but it doesn't appear to be very safe. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
