Commit 24516565 authored by Ming Lei's avatar Ming Lei Committed by Jens Axboe
Browse files

blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none 



After grabbing q->sysfs_lock, q->elevator may become NULL because of
elevator switch.

Fix the NULL dereference on q->elevator by checking it with lock.

Reported-by: default avatarGuangwu Zhang <guazhang@redhat.com>
Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20230616132354.415109-1-ming.lei@redhat.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 84bd06c6

block/blk-mq.c

+7 −3
Original line number Diff line number Diff line
@@ -4604,9 +4604,6 @@ static bool blk_mq_elv_switch_none(struct list_head *head, 
{

	struct blk_mq_qe_pair *qe;



	if (!q->elevator)

		return true;



	qe = kmalloc(sizeof(*qe), GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY);

	if (!qe)

		return false;
@@ -4614,6 +4611,12 @@ static bool blk_mq_elv_switch_none(struct list_head *head, 
	/* q->elevator needs protection from ->sysfs_lock */

	mutex_lock(&q->sysfs_lock);



	/* the check has to be done with holding sysfs_lock */

	if (!q->elevator) {

		kfree(qe);

		goto unlock;

	}



	INIT_LIST_HEAD(&qe->node);

	qe->q = q;

	qe->type = q->elevator->type;
@@ -4621,6 +4624,7 @@ static bool blk_mq_elv_switch_none(struct list_head *head, 
	__elevator_get(qe->type);

	list_add(&qe->node, head);

	elevator_disable(q);

unlock:

	mutex_unlock(&q->sysfs_lock);



	return true;