4faa3c8150
When switching scheduler from cfq, cfq_exit_queue() does not clear
ioc->ioc_data, leaving a dangling pointer that can deceive the following
lookups when the iosched is switched back to cfq. The pattern that can
trigger that is the following:
- elevator switch from cfq to something else;
- module unloading, with elv_unregister() that calls cfq_free_io_context()
on ioc freeing the cic (via the .trim op);
- module gets reloaded and the elevator switches back to cfq;
- reallocation of a cic at the same address as before (with a valid key).
To fix it just assign NULL to ioc_data in __cfq_exit_single_io_context(),
that is called from the regular exit path and from the elevator switching
code. The only path that frees a cic and is not covered is the error handling
one, but cic's freed in this way are never cached in ioc_data.
Signed-off-by: Fabio Checconi <fabio@gandalf.sssup.it>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Kconfig.iosched | ||
| Makefile | ||
| as-iosched.c | ||
| blk-barrier.c | ||
| blk-core.c | ||
| blk-exec.c | ||
| blk-ioc.c | ||
| blk-map.c | ||
| blk-merge.c | ||
| blk-settings.c | ||
| blk-sysfs.c | ||
| blk-tag.c | ||
| blk.h | ||
| blktrace.c | ||
| bsg.c | ||
| cfq-iosched.c | ||
| compat_ioctl.c | ||
| deadline-iosched.c | ||
| elevator.c | ||
| genhd.c | ||
| ioctl.c | ||
| noop-iosched.c | ||
| scsi_ioctl.c | ||