Re: [PATCH 1/2] Revert "blk-mq: fix hctx/ctx kobject use-after-free"
Am 03.02.2015 um 22:50 schrieb Jens Axboe: > On 02/03/2015 12:14 PM, Jens Axboe wrote: >> On 02/03/2015 12:13 PM, Stefan Seyfried wrote: >>> Am 29.01.2015 um 13:17 schrieb Ming Lei: This reverts commit 76d697d10769048e5721510100bf3a9413a56385. >>> The revert is not yet in Linus' tree (but it should get there before >>> 3.19 is released, or all USB-stick users will be unhappy). >> >> It'll go out later today. > > It's in Linus' tree now. ...and works well for my trivial "plug and unplug an USB stick" testcase. (I did not want to push, just make sure it wasn't forgotten :) Thanks all, Stefan -- Stefan Seyfried Linux Consultant & Developer -- GPG Key: 0x731B665B B1 Systems GmbH Osterfeldstraße 7 / 85088 Vohburg / http://www.b1-systems.de GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt,HRB 3537 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH 1/2] Revert "blk-mq: fix hctx/ctx kobject use-after-free"
On 02/03/2015 12:14 PM, Jens Axboe wrote: On 02/03/2015 12:13 PM, Stefan Seyfried wrote: Am 29.01.2015 um 13:17 schrieb Ming Lei: This reverts commit 76d697d10769048e5721510100bf3a9413a56385. The commit 76d697d10769048 causes general protection fault reported from Bart Van Assche: https://lkml.org/lkml/2015/1/28/334 I bisected the "unplugging my USB stick crashes the kernel" problem today and came to this very commit. The revert is not yet in Linus' tree (but it should get there before 3.19 is released, or all USB-stick users will be unhappy). It'll go out later today. It's in Linus' tree now. -- Jens Axboe -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH 1/2] Revert "blk-mq: fix hctx/ctx kobject use-after-free"
Am 29.01.2015 um 13:17 schrieb Ming Lei: > This reverts commit 76d697d10769048e5721510100bf3a9413a56385. > > The commit 76d697d10769048 causes general protection fault > reported from Bart Van Assche: > > https://lkml.org/lkml/2015/1/28/334 I bisected the "unplugging my USB stick crashes the kernel" problem today and came to this very commit. The revert is not yet in Linus' tree (but it should get there before 3.19 is released, or all USB-stick users will be unhappy). Best regards, Stefan > Reported-by: Bart Van Assche > Signed-off-by: Ming Lei -- Stefan Seyfried Linux Consultant & Developer -- GPG Key: 0x731B665B B1 Systems GmbH Osterfeldstraße 7 / 85088 Vohburg / http://www.b1-systems.de GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt,HRB 3537 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH 1/2] Revert "blk-mq: fix hctx/ctx kobject use-after-free"
On 02/03/2015 12:13 PM, Stefan Seyfried wrote: Am 29.01.2015 um 13:17 schrieb Ming Lei: This reverts commit 76d697d10769048e5721510100bf3a9413a56385. The commit 76d697d10769048 causes general protection fault reported from Bart Van Assche: https://lkml.org/lkml/2015/1/28/334 I bisected the "unplugging my USB stick crashes the kernel" problem today and came to this very commit. The revert is not yet in Linus' tree (but it should get there before 3.19 is released, or all USB-stick users will be unhappy). It'll go out later today. -- Jens Axboe -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH 1/2] Revert blk-mq: fix hctx/ctx kobject use-after-free
Am 03.02.2015 um 22:50 schrieb Jens Axboe: On 02/03/2015 12:14 PM, Jens Axboe wrote: On 02/03/2015 12:13 PM, Stefan Seyfried wrote: Am 29.01.2015 um 13:17 schrieb Ming Lei: This reverts commit 76d697d10769048e5721510100bf3a9413a56385. The revert is not yet in Linus' tree (but it should get there before 3.19 is released, or all USB-stick users will be unhappy). It'll go out later today. It's in Linus' tree now. ...and works well for my trivial plug and unplug an USB stick testcase. (I did not want to push, just make sure it wasn't forgotten :) Thanks all, Stefan -- Stefan Seyfried Linux Consultant Developer -- GPG Key: 0x731B665B B1 Systems GmbH Osterfeldstraße 7 / 85088 Vohburg / http://www.b1-systems.de GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt,HRB 3537 -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH 1/2] Revert blk-mq: fix hctx/ctx kobject use-after-free
Am 29.01.2015 um 13:17 schrieb Ming Lei: This reverts commit 76d697d10769048e5721510100bf3a9413a56385. The commit 76d697d10769048 causes general protection fault reported from Bart Van Assche: https://lkml.org/lkml/2015/1/28/334 I bisected the unplugging my USB stick crashes the kernel problem today and came to this very commit. The revert is not yet in Linus' tree (but it should get there before 3.19 is released, or all USB-stick users will be unhappy). Best regards, Stefan Reported-by: Bart Van Assche bart.vanass...@sandisk.com Signed-off-by: Ming Lei ming@canonical.com -- Stefan Seyfried Linux Consultant Developer -- GPG Key: 0x731B665B B1 Systems GmbH Osterfeldstraße 7 / 85088 Vohburg / http://www.b1-systems.de GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt,HRB 3537 -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH 1/2] Revert blk-mq: fix hctx/ctx kobject use-after-free
On 02/03/2015 12:13 PM, Stefan Seyfried wrote: Am 29.01.2015 um 13:17 schrieb Ming Lei: This reverts commit 76d697d10769048e5721510100bf3a9413a56385. The commit 76d697d10769048 causes general protection fault reported from Bart Van Assche: https://lkml.org/lkml/2015/1/28/334 I bisected the unplugging my USB stick crashes the kernel problem today and came to this very commit. The revert is not yet in Linus' tree (but it should get there before 3.19 is released, or all USB-stick users will be unhappy). It'll go out later today. -- Jens Axboe -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH 1/2] Revert blk-mq: fix hctx/ctx kobject use-after-free
On 02/03/2015 12:14 PM, Jens Axboe wrote: On 02/03/2015 12:13 PM, Stefan Seyfried wrote: Am 29.01.2015 um 13:17 schrieb Ming Lei: This reverts commit 76d697d10769048e5721510100bf3a9413a56385. The commit 76d697d10769048 causes general protection fault reported from Bart Van Assche: https://lkml.org/lkml/2015/1/28/334 I bisected the unplugging my USB stick crashes the kernel problem today and came to this very commit. The revert is not yet in Linus' tree (but it should get there before 3.19 is released, or all USB-stick users will be unhappy). It'll go out later today. It's in Linus' tree now. -- Jens Axboe -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 1/2] Revert "blk-mq: fix hctx/ctx kobject use-after-free"
This reverts commit 76d697d10769048e5721510100bf3a9413a56385.
The commit 76d697d10769048 causes general protection fault
reported from Bart Van Assche:
https://lkml.org/lkml/2015/1/28/334
Reported-by: Bart Van Assche
Signed-off-by: Ming Lei
---
block/blk-mq-sysfs.c | 25 ++---
block/blk-mq.c |6 +-
2 files changed, 7 insertions(+), 24 deletions(-)
diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index 6774a0e..1630a20 100644
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -15,26 +15,6 @@
static void blk_mq_sysfs_release(struct kobject *kobj)
{
- struct request_queue *q;
-
- q = container_of(kobj, struct request_queue, mq_kobj);
- free_percpu(q->queue_ctx);
-}
-
-static void blk_mq_ctx_release(struct kobject *kobj)
-{
- struct blk_mq_ctx *ctx;
-
- ctx = container_of(kobj, struct blk_mq_ctx, kobj);
- kobject_put(>queue->mq_kobj);
-}
-
-static void blk_mq_hctx_release(struct kobject *kobj)
-{
- struct blk_mq_hw_ctx *hctx;
-
- hctx = container_of(kobj, struct blk_mq_hw_ctx, kobj);
- kfree(hctx);
}
struct blk_mq_ctx_sysfs_entry {
@@ -338,13 +318,13 @@ static struct kobj_type blk_mq_ktype = {
static struct kobj_type blk_mq_ctx_ktype = {
.sysfs_ops = _mq_sysfs_ops,
.default_attrs = default_ctx_attrs,
- .release= blk_mq_ctx_release,
+ .release= blk_mq_sysfs_release,
};
static struct kobj_type blk_mq_hw_ktype = {
.sysfs_ops = _mq_hw_sysfs_ops,
.default_attrs = default_hw_ctx_attrs,
- .release= blk_mq_hctx_release,
+ .release= blk_mq_sysfs_release,
};
static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
@@ -375,7 +355,6 @@ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
return ret;
hctx_for_each_ctx(hctx, ctx, i) {
- kobject_get(>mq_kobj);
ret = kobject_add(>kobj, >kobj, "cpu%u", ctx->cpu);
if (ret)
break;
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 51ce53d..a880b6c 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1644,8 +1644,10 @@ static void blk_mq_free_hw_queues(struct request_queue
*q,
struct blk_mq_hw_ctx *hctx;
unsigned int i;
- queue_for_each_hw_ctx(q, hctx, i)
+ queue_for_each_hw_ctx(q, hctx, i) {
free_cpumask_var(hctx->cpumask);
+ kfree(hctx);
+ }
}
static int blk_mq_init_hctx(struct request_queue *q,
@@ -2003,9 +2005,11 @@ void blk_mq_free_queue(struct request_queue *q)
percpu_ref_exit(>mq_usage_counter);
+ free_percpu(q->queue_ctx);
kfree(q->queue_hw_ctx);
kfree(q->mq_map);
+ q->queue_ctx = NULL;
q->queue_hw_ctx = NULL;
q->mq_map = NULL;
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 1/2] Revert blk-mq: fix hctx/ctx kobject use-after-free
This reverts commit 76d697d10769048e5721510100bf3a9413a56385.
The commit 76d697d10769048 causes general protection fault
reported from Bart Van Assche:
https://lkml.org/lkml/2015/1/28/334
Reported-by: Bart Van Assche bart.vanass...@sandisk.com
Signed-off-by: Ming Lei ming@canonical.com
---
block/blk-mq-sysfs.c | 25 ++---
block/blk-mq.c |6 +-
2 files changed, 7 insertions(+), 24 deletions(-)
diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index 6774a0e..1630a20 100644
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -15,26 +15,6 @@
static void blk_mq_sysfs_release(struct kobject *kobj)
{
- struct request_queue *q;
-
- q = container_of(kobj, struct request_queue, mq_kobj);
- free_percpu(q-queue_ctx);
-}
-
-static void blk_mq_ctx_release(struct kobject *kobj)
-{
- struct blk_mq_ctx *ctx;
-
- ctx = container_of(kobj, struct blk_mq_ctx, kobj);
- kobject_put(ctx-queue-mq_kobj);
-}
-
-static void blk_mq_hctx_release(struct kobject *kobj)
-{
- struct blk_mq_hw_ctx *hctx;
-
- hctx = container_of(kobj, struct blk_mq_hw_ctx, kobj);
- kfree(hctx);
}
struct blk_mq_ctx_sysfs_entry {
@@ -338,13 +318,13 @@ static struct kobj_type blk_mq_ktype = {
static struct kobj_type blk_mq_ctx_ktype = {
.sysfs_ops = blk_mq_sysfs_ops,
.default_attrs = default_ctx_attrs,
- .release= blk_mq_ctx_release,
+ .release= blk_mq_sysfs_release,
};
static struct kobj_type blk_mq_hw_ktype = {
.sysfs_ops = blk_mq_hw_sysfs_ops,
.default_attrs = default_hw_ctx_attrs,
- .release= blk_mq_hctx_release,
+ .release= blk_mq_sysfs_release,
};
static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
@@ -375,7 +355,6 @@ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
return ret;
hctx_for_each_ctx(hctx, ctx, i) {
- kobject_get(q-mq_kobj);
ret = kobject_add(ctx-kobj, hctx-kobj, cpu%u, ctx-cpu);
if (ret)
break;
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 51ce53d..a880b6c 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1644,8 +1644,10 @@ static void blk_mq_free_hw_queues(struct request_queue
*q,
struct blk_mq_hw_ctx *hctx;
unsigned int i;
- queue_for_each_hw_ctx(q, hctx, i)
+ queue_for_each_hw_ctx(q, hctx, i) {
free_cpumask_var(hctx-cpumask);
+ kfree(hctx);
+ }
}
static int blk_mq_init_hctx(struct request_queue *q,
@@ -2003,9 +2005,11 @@ void blk_mq_free_queue(struct request_queue *q)
percpu_ref_exit(q-mq_usage_counter);
+ free_percpu(q-queue_ctx);
kfree(q-queue_hw_ctx);
kfree(q-mq_map);
+ q-queue_ctx = NULL;
q-queue_hw_ctx = NULL;
q-mq_map = NULL;
--
1.7.9.5
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
