summaryrefslogtreecommitdiff
path: root/block
diff options
context:
space:
mode:
authorBart Van Assche <bart.vanassche@sandisk.com>2017-04-26 23:47:52 +0300
committerJens Axboe <axboe@fb.com>2017-04-27 00:09:04 +0300
commite869b5462f83bcc771a3301fa7c8de47ed8c74f5 (patch)
tree3fe1868219d4506580b19b5738632a6f2baaa041 /block
parentf05d1ba7871a2c20ca9ebb303aac89c9296d1f58 (diff)
downloadlinux-e869b5462f83bcc771a3301fa7c8de47ed8c74f5.tar.xz
blk-mq: Unregister debugfs attributes earlier
We currently call blk_mq_free_queue() from blk_cleanup_queue() before we unregister the debugfs attributes for that queue in blk_release_queue(). This leaves a window open during which accessing most of the mq debugfs attributes would cause a use-after-free. Additionally, the "state" attribute allows running the queue, which we should not do after the queue has entered the "dead" state. Fix both cases by unregistering the debugfs attributes before freeing queue resources starts. Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Reviewed-by: Omar Sandoval <osandov@fb.com> Signed-off-by: Jens Axboe <axboe@fb.com>
Diffstat (limited to 'block')
-rw-r--r--block/blk-core.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/block/blk-core.c b/block/blk-core.c
index a49b0830aaaf..6bd4d1754d29 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -563,9 +563,13 @@ void blk_cleanup_queue(struct request_queue *q)
* prevent that q->request_fn() gets invoked after draining finished.
*/
blk_freeze_queue(q);
- spin_lock_irq(lock);
- if (!q->mq_ops)
+ if (!q->mq_ops) {
+ spin_lock_irq(lock);
__blk_drain_queue(q, true);
+ } else {
+ blk_mq_debugfs_unregister_mq(q);
+ spin_lock_irq(lock);
+ }
queue_flag_set(QUEUE_FLAG_DEAD, q);
spin_unlock_irq(lock);