Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934067AbbDQOEp (ORCPT ); Fri, 17 Apr 2015 10:04:45 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:33945 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754356AbbDQNfg (ORCPT ); Fri, 17 Apr 2015 09:35:36 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sam Bradshaw , Selvan Mani , Jens Axboe Subject: [PATCH 3.19 017/101] blkmq: Fix NULL pointer deref when all reserved tags in Date: Fri, 17 Apr 2015 15:28:05 +0200 Message-Id: <20150417132515.164140532@linuxfoundation.org> X-Mailer: git-send-email 2.3.5 In-Reply-To: <20150417132514.379828774@linuxfoundation.org> References: <20150417132514.379828774@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1729 Lines: 50 3.19-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sam Bradshaw commit bc188d818edf325ae38cfa43254a0b10a4defd65 upstream. When allocating from the reserved tags pool, bt_get() is called with a NULL hctx. If all tags are in use, the hw queue is kicked to push out any pending IO, potentially freeing tags, and tag allocation is retried. The problem is that blk_mq_run_hw_queue() doesn't check for a NULL hctx. So we avoid it with a simple NULL hctx test. Tested by hammering mtip32xx with concurrent smartctl/hdparm. Signed-off-by: Sam Bradshaw Signed-off-by: Selvan Mani Fixes: b32232073e80 ("blk-mq: fix hang in bt_get()") Added appropriate comment. Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- block/blk-mq-tag.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/block/blk-mq-tag.c +++ b/block/blk-mq-tag.c @@ -265,9 +265,11 @@ static int bt_get(struct blk_mq_alloc_da /* * We're out of tags on this hardware queue, kick any * pending IO submits before going to sleep waiting for - * some to complete. + * some to complete. Note that hctx can be NULL here for + * reserved tag allocation. */ - blk_mq_run_hw_queue(hctx, false); + if (hctx) + blk_mq_run_hw_queue(hctx, false); /* * Retry tag allocation after running the hardware queue, -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/