lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "block: Fix use-after-free while iterating over requests"

Browse Source 
commit 10ee57c29e ("block: Fix use-after-free while iterating over
requests")
This is needed to fix regression observed in suspend/resume
paths where the tag corresponds to static_rqs is becoming
NULL and observed a kernel panic due to NULL pointer access in
blk_mq_get_rq().

89.824342:   <2> Call trace:
89.824356:   <2>  blk_mq_get_request+0x200/0x3ec
89.824367:   <2>  blk_mq_alloc_request+0x5c/0xb4
89.824382:   <2>  blk_get_request+0x2c/0xa4
89.824398:   <2>  __scsi_execute+0x58/0x1a0
89.824413:   <2>  ufshcd_set_dev_pwr_mode+0x174/0x248
89.824425:   <2>  ufshcd_suspend+0x2e8/0x830
89.824436:   <2>  ufshcd_runtime_suspend+0x44/0x194
89.824452:   <2>  ufshcd_pltfrm_runtime_suspend+0x14/0x20
89.824468:   <2>  pm_generic_runtime_suspend+0x44/0x80
89.824481:   <2>  __rpm_callback+0x98/0x1d8
89.824493:   <2>  rpm_suspend+0x31c/0x634
89.824505:   <2>  rpm_idle+0x158/0x228.

Change-Id: I5bc3d75a9d891054dc926171b3ad90b701d776d6
Signed-off-by: Pradeep P V K <pragalla@codeaurora.org>
This commit is contained in:
Pradeep P V K 2020-12-21 21:04:02 +05:30
parent af305c96f5
commit 30ed308e3c
2 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
block/blk-mq.c
View File

@ -497,7 +497,6 @@ static void __blk_mq_free_request(struct request *rq)
const int sched_tag = rq->internal_tag;
blk_pm_mark_last_busy(rq);
hctx->tags->rqs[rq->tag] = NULL;
rq->mq_hctx = NULL;
if (rq->tag != -1)
blk_mq_put_tag(hctx, hctx->tags, ctx, rq->tag);

2
block/blk-mq.h
View File

@ -209,7 +209,6 @@ static inline bool blk_mq_get_dispatch_budget(struct blk_mq_hw_ctx *hctx)
static inline void __blk_mq_put_driver_tag(struct blk_mq_hw_ctx *hctx,
struct request *rq)
{
hctx->tags->rqs[rq->tag] = NULL;
blk_mq_put_tag(hctx, hctx->tags, rq->mq_ctx, rq->tag);
rq->tag = -1;
@ -223,6 +222,7 @@ static inline void blk_mq_put_driver_tag(struct request *rq)
{
if (rq->tag == -1 || rq->internal_tag == -1)
return;
__blk_mq_put_driver_tag(rq->mq_hctx, rq);
}