summaryrefslogtreecommitdiff
path: root/block
diff options
context:
space:
mode:
authorMing Lei <ming.lei@redhat.com>2023-06-16 16:23:54 +0300
committerJens Axboe <axboe@kernel.dk>2023-06-16 19:12:25 +0300
commit245165658e1c9f95c0fecfe02b9b1ebd30a1198a (patch)
tree0afb4aef73404f0134af73f0cfcab25953a39e0b /block
parent84bd06c632c6d5279849f5f8ab47d9517d259422 (diff)
downloadlinux-245165658e1c9f95c0fecfe02b9b1ebd30a1198a.tar.xz
blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none
After grabbing q->sysfs_lock, q->elevator may become NULL because of elevator switch. Fix the NULL dereference on q->elevator by checking it with lock. Reported-by: Guangwu Zhang <guazhang@redhat.com> Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://lore.kernel.org/r/20230616132354.415109-1-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block')
-rw-r--r--block/blk-mq.c10
1 files changed, 7 insertions, 3 deletions
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 24dc8fe0a9d2..16c524e37123 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4604,9 +4604,6 @@ static bool blk_mq_elv_switch_none(struct list_head *head,
{
struct blk_mq_qe_pair *qe;
- if (!q->elevator)
- return true;
-
qe = kmalloc(sizeof(*qe), GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY);
if (!qe)
return false;
@@ -4614,6 +4611,12 @@ static bool blk_mq_elv_switch_none(struct list_head *head,
/* q->elevator needs protection from ->sysfs_lock */
mutex_lock(&q->sysfs_lock);
+ /* the check has to be done with holding sysfs_lock */
+ if (!q->elevator) {
+ kfree(qe);
+ goto unlock;
+ }
+
INIT_LIST_HEAD(&qe->node);
qe->q = q;
qe->type = q->elevator->type;
@@ -4621,6 +4624,7 @@ static bool blk_mq_elv_switch_none(struct list_head *head,
__elevator_get(qe->type);
list_add(&qe->node, head);
elevator_disable(q);
+unlock:
mutex_unlock(&q->sysfs_lock);
return true;