mirror of
https://github.com/torvalds/linux.git
synced 2024-12-06 11:01:43 +00:00
NVMe: Fix possible queue use after freed
This notifies blk-mq when the tag set contains a different number of queues prior to freeing unused ones that the request queue points to. Signed-off-by: Keith Busch <keith.busch@intel.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@fb.com>
This commit is contained in:
parent
868f2f0b72
commit
949928c1c7
@ -1381,7 +1381,7 @@ static int nvme_kthread(void *data)
|
|||||||
|
|
||||||
static int nvme_create_io_queues(struct nvme_dev *dev)
|
static int nvme_create_io_queues(struct nvme_dev *dev)
|
||||||
{
|
{
|
||||||
unsigned i;
|
unsigned i, max;
|
||||||
int ret = 0;
|
int ret = 0;
|
||||||
|
|
||||||
for (i = dev->queue_count; i <= dev->max_qid; i++) {
|
for (i = dev->queue_count; i <= dev->max_qid; i++) {
|
||||||
@ -1391,7 +1391,8 @@ static int nvme_create_io_queues(struct nvme_dev *dev)
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
for (i = dev->online_queues; i <= dev->queue_count - 1; i++) {
|
max = min(dev->max_qid, dev->queue_count - 1);
|
||||||
|
for (i = dev->online_queues; i <= max; i++) {
|
||||||
ret = nvme_create_queue(dev->queues[i], i);
|
ret = nvme_create_queue(dev->queues[i], i);
|
||||||
if (ret) {
|
if (ret) {
|
||||||
nvme_free_queues(dev, i);
|
nvme_free_queues(dev, i);
|
||||||
@ -1548,9 +1549,6 @@ static int nvme_setup_io_queues(struct nvme_dev *dev)
|
|||||||
adminq->cq_vector = -1;
|
adminq->cq_vector = -1;
|
||||||
goto free_queues;
|
goto free_queues;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Free previously allocated queues that are no longer usable */
|
|
||||||
nvme_free_queues(dev, nr_io_queues + 1);
|
|
||||||
return nvme_create_io_queues(dev);
|
return nvme_create_io_queues(dev);
|
||||||
|
|
||||||
free_queues:
|
free_queues:
|
||||||
@ -1684,7 +1682,13 @@ static int nvme_dev_add(struct nvme_dev *dev)
|
|||||||
if (blk_mq_alloc_tag_set(&dev->tagset))
|
if (blk_mq_alloc_tag_set(&dev->tagset))
|
||||||
return 0;
|
return 0;
|
||||||
dev->ctrl.tagset = &dev->tagset;
|
dev->ctrl.tagset = &dev->tagset;
|
||||||
|
} else {
|
||||||
|
blk_mq_update_nr_hw_queues(&dev->tagset, dev->online_queues - 1);
|
||||||
|
|
||||||
|
/* Free previously allocated queues that are no longer usable */
|
||||||
|
nvme_free_queues(dev, dev->online_queues);
|
||||||
}
|
}
|
||||||
|
|
||||||
queue_work(nvme_workq, &dev->scan_work);
|
queue_work(nvme_workq, &dev->scan_work);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user