mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 05:48:40 +00:00
![]() When switching scheduler from cfq, cfq_exit_queue() does not clear ioc->ioc_data, leaving a dangling pointer that can deceive the following lookups when the iosched is switched back to cfq. The pattern that can trigger that is the following: - elevator switch from cfq to something else; - module unloading, with elv_unregister() that calls cfq_free_io_context() on ioc freeing the cic (via the .trim op); - module gets reloaded and the elevator switches back to cfq; - reallocation of a cic at the same address as before (with a valid key). To fix it just assign NULL to ioc_data in __cfq_exit_single_io_context(), that is called from the regular exit path and from the elevator switching code. The only path that frees a cic and is not covered is the error handling one, but cic's freed in this way are never cached in ioc_data. Signed-off-by: Fabio Checconi <fabio@gandalf.sssup.it> Signed-off-by: Jens Axboe <jens.axboe@oracle.com> |
||
---|---|---|
.. | ||
as-iosched.c | ||
blk-barrier.c | ||
blk-core.c | ||
blk-exec.c | ||
blk-ioc.c | ||
blk-map.c | ||
blk-merge.c | ||
blk-settings.c | ||
blk-sysfs.c | ||
blk-tag.c | ||
blk.h | ||
blktrace.c | ||
bsg.c | ||
cfq-iosched.c | ||
compat_ioctl.c | ||
deadline-iosched.c | ||
elevator.c | ||
genhd.c | ||
ioctl.c | ||
Kconfig | ||
Kconfig.iosched | ||
Makefile | ||
noop-iosched.c | ||
scsi_ioctl.c |