Skip to contentSkip to conversation

FAILED: patch "[PATCH] nvme/pci: Don't free queues on error" failed to apply to 4.8-stable tree

PATCH [email protected] 1 participant 1 message Nov 21, 2016

Subsystems (2)
Stable branch NVMe
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.8-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

Quoted 1 line

From d48756228ee9161ac8836b346589a43fabdc9f3c Mon Sep 17 00:00:00 2001

From: Keith Busch <[email protected]>
Date: Tue, 15 Nov 2016 15:56:26 -0500
Subject: [PATCH] nvme/pci: Don't free queues on error

The nvme_remove function tears down all allocated resources in the correct order, so no need to free queues on error during initialization. This fixes possible use-after-free errors when queues are still associated with a blk-mq hctx.

Reported-by Scott Bauer <[email protected]>
Tested-by Scott Bauer <[email protected]>
Signed-off-by Keith Busch <[email protected]>
Reviewed-by Sagi Grimberg <[email protected]>
Reviewed-by Christoph Hellwig <[email protected]>
Cc [email protected]
Signed-off-by Jens Axboe <[email protected]>
drivers/nvme/host/pci.c +4 -14
index 0248d0e21fee..5e52034ab010 100644
@@ -1242,20 +1242,16 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
 
 	result = nvme_enable_ctrl(&dev->ctrl, cap);
 	if (result)
-		goto free_nvmeq;
+		return result;
 
 	nvmeq->cq_vector = 0;
 	result = queue_request_irq(nvmeq);
 	if (result) {
 		nvmeq->cq_vector = -1;
-		goto free_nvmeq;
+		return result;
 	}
 
 	return result;
-
- free_nvmeq:
-	nvme_free_queues(dev, 0);
-	return result;
 }
 
 static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)

@@ -1317,10 +1313,8 @@ static int nvme_create_io_queues(struct nvme_dev *dev)
 	max = min(dev->max_qid, dev->queue_count - 1);
 	for (i = dev->online_queues; i <= max; i++) {
 		ret = nvme_create_queue(dev->queues[i], i);
-		if (ret) {
-			nvme_free_queues(dev, i);
+		if (ret)
 			break;
-		}
 	}
 
 	/*

@@ -1460,13 +1454,9 @@ static int nvme_setup_io_queues(struct nvme_dev *dev)
 	result = queue_request_irq(adminq);
 	if (result) {
 		adminq->cq_vector = -1;
-		goto free_queues;
+		return result;
 	}
 	return nvme_create_io_queues(dev);
-
- free_queues:
-	nvme_free_queues(dev, 1);
-	return result;
 }
 
 static void nvme_del_queue_end(struct request *req, int error)