OpenCloudOS-Kernel/block
Weiping Zhang aa880ad690 block: reset mapping if failed to update hardware queue count
When we increase hardware queue count, blk_mq_update_queue_map will
reset the mapping between cpu and hardware queue base on the hardware
queue count(set->nr_hw_queues). The mapping cannot be reset if it
encounters error in blk_mq_realloc_hw_ctxs, but the fallback flow will
continue using it, then blk_mq_map_swqueue will touch a invalid memory,
because the mapping points to a wrong hctx.

blktest block/030:

null_blk: module loaded
Increasing nr_hw_queues to 8 fails, fallback to 1
==================================================================
BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0x2f2/0x830
Read of size 8 at addr 0000000000000128 by task nproc/8541

CPU: 5 PID: 8541 Comm: nproc Not tainted 5.7.0-rc4-dbg+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.13.0-0-gf21b5a4-rebuilt.opensuse.org 04/01/2014
Call Trace:
dump_stack+0xa5/0xe6
__kasan_report.cold+0x65/0xbb
kasan_report+0x45/0x60
check_memory_region+0x15e/0x1c0
__kasan_check_read+0x15/0x20
blk_mq_map_swqueue+0x2f2/0x830
__blk_mq_update_nr_hw_queues+0x3df/0x690
blk_mq_update_nr_hw_queues+0x32/0x50
nullb_device_submit_queues_store+0xde/0x160 [null_blk]
configfs_write_file+0x1c4/0x250 [configfs]
__vfs_write+0x4c/0x90
vfs_write+0x14b/0x2d0
ksys_write+0xdd/0x180
__x64_sys_write+0x47/0x50
do_syscall_64+0x6f/0x310
entry_SYSCALL_64_after_hwframe+0x49/0xb3

Signed-off-by: Weiping Zhang <zhangweiping@didiglobal.com>
Tested-by: Bart van Assche <bvanassche@acm.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-05-12 20:20:22 -06:00
..
partitions Merge branch 'block-5.7' into for-5.8/block 2020-05-09 16:13:58 -06:00
Kconfig blk-iocost: account for IO size when testing latencies 2020-04-30 15:54:45 -06:00
Kconfig.iosched blk-cgroup: separate out blkg_rwstat under CONFIG_BLK_CGROUP_RWSTAT 2019-11-07 12:28:13 -07:00
Makefile block: merge partition-generic.c and check.c 2020-03-24 07:57:08 -06:00
badblocks.c block: switch all files cleared marked as GPLv2 to SPDX tags 2019-04-30 16:11:57 -06:00
bfq-cgroup.c block, bfq: invoke flush_idle_tree after reparent_active_queues in pd_offline 2020-03-21 14:31:03 -06:00
bfq-iosched.c bdi: use bdi_dev_name() to get device name 2020-05-09 16:07:39 -06:00
bfq-iosched.h block, bfq: turn put_queue into release_process_ref in __bfq_bic_change_cgroup 2020-03-21 14:31:00 -06:00
bfq-wf2q.c block, bfq: get a ref to a group when adding it to a service tree 2020-02-03 06:58:15 -07:00
bio-integrity.c block: fix memleak of bio integrity data 2019-12-05 11:38:36 -07:00
bio.c block: move bio_map_* to blk-map.c 2020-03-27 12:04:34 -06:00
blk-cgroup-rwstat.c blk-cgroup: separate out blkg_rwstat under CONFIG_BLK_CGROUP_RWSTAT 2019-11-07 12:28:13 -07:00
blk-cgroup-rwstat.h blk-cgroup: separate out blkg_rwstat under CONFIG_BLK_CGROUP_RWSTAT 2019-11-07 12:28:13 -07:00
blk-cgroup.c Merge branch 'block-5.7' into for-5.8/block 2020-05-09 16:13:58 -06:00
blk-core.c bdi: remove the name field in struct backing_dev_info 2020-05-09 16:15:13 -06:00
blk-exec.c block: account statistics for passthrough requests 2019-10-10 17:52:31 -06:00
blk-flush.c Revert "blkdev: check for valid request queue before issuing flush" 2020-03-27 10:23:44 -06:00
blk-integrity.c block: centralize PI remapping logic to the block layer 2019-09-17 20:03:49 -06:00
blk-ioc.c block: Fix use-after-free issue accessing struct io_cq 2020-03-12 07:07:38 -06:00
blk-iocost.c Merge branch 'block-5.7' into for-5.8/block 2020-05-09 16:13:58 -06:00
blk-iolatency.c blkcg: s/RQ_QOS_CGROUP/RQ_QOS_LATENCY/ 2019-08-28 21:17:08 -06:00
blk-lib.c block: fix 32 bit overflow in __blkdev_issue_discard() 2018-11-14 08:17:18 -07:00
blk-map.c block: remove RQF_COPY_USER 2020-04-22 10:47:06 -06:00
blk-merge.c block: replace BIO_QUEUE_ENTERED with BIO_CGROUP_ACCT 2020-04-29 09:33:26 -06:00
blk-mq-cpumap.c blk-mq: balance mapping between present CPUs and queues 2019-08-04 21:43:12 -06:00
blk-mq-debugfs-zoned.c block: Cleanup license notice 2019-01-17 21:21:40 -07:00
blk-mq-debugfs.c block: remove RQF_COPY_USER 2020-04-22 10:47:06 -06:00
blk-mq-debugfs.h blk-mq: no need to check return value of debugfs_create functions 2019-06-13 03:00:30 -06:00
blk-mq-pci.c block: Fix blk_mq_*_map_queues() kernel-doc headers 2019-05-31 15:12:34 -06:00
blk-mq-rdma.c block: Fix blk_mq_*_map_queues() kernel-doc headers 2019-05-31 15:12:34 -06:00
blk-mq-sched.c blk-mq: make function '__blk_mq_sched_dispatch_requests' static 2020-04-29 09:16:53 -06:00
blk-mq-sched.h block: blk-mq: Remove blk_mq_sched_started_request and started_request 2019-07-23 07:25:09 -06:00
blk-mq-sysfs.c blk-mq: make sure that line break can be printed 2019-11-04 07:14:10 -07:00
blk-mq-tag.c blk-mq: Remove some unused function arguments 2020-02-26 10:34:41 -07:00
blk-mq-tag.h blk-mq: Remove some unused function arguments 2020-02-26 10:34:41 -07:00
blk-mq-virtio.c blk-mq: Fix typo in comment 2020-03-17 20:55:21 +01:00
blk-mq.c block: reset mapping if failed to update hardware queue count 2020-05-12 20:20:22 -06:00
blk-mq.h blk-mq: Remove some unused function arguments 2020-02-26 10:34:41 -07:00
blk-pm.c block: bypass blk_set_runtime_active for uninitialized q->dev 2019-09-12 07:11:56 -06:00
blk-pm.h block: remove the queue_lock indirection 2018-11-15 12:17:28 -07:00
blk-rq-qos.c blk-wbt: fix performance regression in wbt scale_up/scale_down 2019-10-06 09:26:41 -06:00
blk-rq-qos.h blk-rq-qos: fix first node deletion of rq_qos_del() 2019-10-15 10:13:13 -06:00
blk-settings.c block: move dma drain handling to scsi 2020-04-22 10:47:35 -06:00
blk-softirq.c block: Don't disable interrupts in trigger_softirq() 2019-11-18 07:29:22 -07:00
blk-stat.c blk-stat: Optimise blk_stat_add() 2019-10-07 21:19:10 -06:00
blk-stat.h block: deactivate blk_stat timer in wbt_disable_default() 2018-12-12 06:47:51 -07:00
blk-sysfs.c block: Remove "dying" checks from sysfs callbacks 2019-10-07 08:31:59 -06:00
blk-throttle.c blk-cgroup: separate out blkg_rwstat under CONFIG_BLK_CGROUP_RWSTAT 2019-11-07 12:28:13 -07:00
blk-timeout.c block: add SPDX tags to block layer files missing licensing information 2019-04-30 16:12:03 -06:00
blk-wbt.c blk-wbt: Use tracepoint_string() for wbt_step tracepoint string literals 2020-04-17 08:21:44 -06:00
blk-wbt.h block/rq_qos: implement rq_qos_ops->queue_depth_changed() 2019-08-28 21:17:07 -06:00
blk-zoned.c for-5.7/drivers-2020-03-29 2020-03-30 11:43:51 -07:00
blk.h block: remove create_io_context 2020-04-25 09:44:40 -06:00
bounce.c block: remove the i argument to bio_for_each_segment_all 2019-04-30 09:26:13 -06:00
bsg-lib.c block: Fix the type of 'sts' in bsg_queue_rq() 2019-12-20 11:52:01 -07:00
bsg.c compat_ioctl: bsg: add handler 2020-01-03 09:33:21 +01:00
cmdline-parser.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
elevator.c Merge branch 'for-linus' into for-5.5/block 2019-11-07 12:27:19 -07:00
genhd.c bdi: remove bdi_register_owner 2020-05-09 16:15:13 -06:00
ioctl.c block: refactor blkpg_ioctl 2020-04-20 11:32:59 -06:00
ioprio.c docs: block: convert to ReST 2019-07-15 09:20:27 -03:00
kyber-iosched.c blk-mq: remove blk_mq_put_ctx() 2019-07-02 21:03:27 -06:00
mq-deadline.c block: Introduce elevator features 2019-09-05 19:52:33 -06:00
opal_proto.h block: sed-opal: Change the check condition for regular session validity 2020-03-12 08:00:10 -06:00
scsi_ioctl.c scsi: core: Allow non-root users to perform ZBC commands 2020-03-16 18:26:31 -04:00
sed-opal.c block: sed-opal: Change the check condition for regular session validity 2020-03-12 08:00:10 -06:00
t10-pi.c block: Allow t10-pi to be modular 2020-01-06 20:59:04 -07:00