6be6d11241
When nr_hw_queues shrink, we free the excess tags before realloc'ing
hw_ctxs for each queue. During that resize, we may need to access those
tags, like blk_mq_tag_idle(hctx) will access queue shared tags.
This can cause a slab use-after-free, as reported by KASAN. Fix it by
moving the releasing of excess tags to the end.
Fixes:
|
||
|---|---|---|
| .. | ||
| partitions | ||
| Kconfig | ||
| Kconfig.iosched | ||
| Makefile | ||
| badblocks.c | ||
| bdev.c | ||
| bfq-cgroup.c | ||
| bfq-iosched.c | ||
| bfq-iosched.h | ||
| bfq-wf2q.c | ||
| bio-integrity.c | ||
| bio.c | ||
| blk-cgroup-fc-appid.c | ||
| blk-cgroup-rwstat.c | ||
| blk-cgroup-rwstat.h | ||
| blk-cgroup.c | ||
| blk-cgroup.h | ||
| blk-core.c | ||
| blk-crypto-fallback.c | ||
| blk-crypto-internal.h | ||
| blk-crypto-profile.c | ||
| blk-crypto-sysfs.c | ||
| blk-crypto.c | ||
| blk-flush.c | ||
| blk-ia-ranges.c | ||
| blk-integrity.c | ||
| blk-ioc.c | ||
| blk-iocost.c | ||
| blk-iolatency.c | ||
| blk-ioprio.c | ||
| blk-ioprio.h | ||
| blk-lib.c | ||
| blk-map.c | ||
| blk-merge.c | ||
| blk-mq-cpumap.c | ||
| blk-mq-debugfs-zoned.c | ||
| blk-mq-debugfs.c | ||
| blk-mq-debugfs.h | ||
| blk-mq-pci.c | ||
| blk-mq-sched.c | ||
| blk-mq-sched.h | ||
| blk-mq-sysfs.c | ||
| blk-mq-tag.c | ||
| blk-mq-virtio.c | ||
| blk-mq.c | ||
| blk-mq.h | ||
| blk-pm.c | ||
| blk-pm.h | ||
| blk-rq-qos.c | ||
| blk-rq-qos.h | ||
| blk-settings.c | ||
| blk-stat.c | ||
| blk-stat.h | ||
| blk-sysfs.c | ||
| blk-throttle.c | ||
| blk-throttle.h | ||
| blk-timeout.c | ||
| blk-wbt.c | ||
| blk-wbt.h | ||
| blk-zoned.c | ||
| blk.h | ||
| bounce.c | ||
| bsg-lib.c | ||
| bsg.c | ||
| disk-events.c | ||
| early-lookup.c | ||
| elevator.c | ||
| elevator.h | ||
| fops.c | ||
| genhd.c | ||
| holder.c | ||
| ioctl.c | ||
| ioprio.c | ||
| kyber-iosched.c | ||
| mq-deadline.c | ||
| opal_proto.h | ||
| sed-opal.c | ||
| t10-pi.c | ||