提交 57053d8c 编写于 作者: M Matias Bjorling 提交者: Linus Torvalds

null_blk: mem garbage on NUMA systems during init

For NUMA systems, initializing the blk-mq layer and using per node hctx.
We initialize submit queues to 1, while blk-mq nr_hw_queues is
initialized to the number of NUMA nodes.

This makes the null_init_hctx function overwrite memory outside of what
it allocated.  In my case it lead to writing garbage into struct
request_queue's mq_map.
Signed-off-by: NMatias Bjorling <m@bjorling.me>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 e4158f1b
...@@ -495,23 +495,23 @@ static int null_add_dev(void) ...@@ -495,23 +495,23 @@ static int null_add_dev(void)
spin_lock_init(&nullb->lock); spin_lock_init(&nullb->lock);
if (queue_mode == NULL_Q_MQ && use_per_node_hctx)
submit_queues = nr_online_nodes;
if (setup_queues(nullb)) if (setup_queues(nullb))
goto err; goto err;
if (queue_mode == NULL_Q_MQ) { if (queue_mode == NULL_Q_MQ) {
null_mq_reg.numa_node = home_node; null_mq_reg.numa_node = home_node;
null_mq_reg.queue_depth = hw_queue_depth; null_mq_reg.queue_depth = hw_queue_depth;
null_mq_reg.nr_hw_queues = submit_queues;
if (use_per_node_hctx) { if (use_per_node_hctx) {
null_mq_reg.ops->alloc_hctx = null_alloc_hctx; null_mq_reg.ops->alloc_hctx = null_alloc_hctx;
null_mq_reg.ops->free_hctx = null_free_hctx; null_mq_reg.ops->free_hctx = null_free_hctx;
null_mq_reg.nr_hw_queues = nr_online_nodes;
} else { } else {
null_mq_reg.ops->alloc_hctx = blk_mq_alloc_single_hw_queue; null_mq_reg.ops->alloc_hctx = blk_mq_alloc_single_hw_queue;
null_mq_reg.ops->free_hctx = blk_mq_free_single_hw_queue; null_mq_reg.ops->free_hctx = blk_mq_free_single_hw_queue;
null_mq_reg.nr_hw_queues = submit_queues;
} }
nullb->q = blk_mq_init_queue(&null_mq_reg, nullb); nullb->q = blk_mq_init_queue(&null_mq_reg, nullb);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册