Skip to contentSkip to conversation

block: free q->flush_rq in blk_init_allocated_queue error paths

PATCH New Jens Axboe 1 participant 1 message Mar 20, 2014 Block layer

lore
Share & tools
lore

Jens Axboe

author
#0 lore raw

PATCH 1/1 block: free q->flush_rq in blk_init_allocated_queue error paths

Hi Linus,

Turns out there was a potential leak in the error path of the flush fixup from the last pull, which Dave Jones spotted.

Can you apply this to your current tree before tagging 3.14? Thanks!

From: Dave Jones <[email protected]>

Commit 7982e90c3a ("block: fix q->flush_rq NULL pointer crash on dm-mpath flush") moved an allocation to blk_init_allocated_queue(), but neglected to free that allocation on the error paths that follow.

Signed-off-by Dave Jones <[email protected]>
Acked-by Mike Snitzer <[email protected]>
Signed-off-by Jens Axboe <[email protected]>
block/blk-core.c +6 -2
index 4cd5ffc18442..bfe16d5af9f9 100644
@@ -713,7 +713,7 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
 		return NULL;
 
 	if (blk_init_rl(&q->root_rl, q, GFP_KERNEL))
-		return NULL;
+		goto fail;
 
 	q->request_fn		= rfn;
 	q->prep_rq_fn		= NULL;

@@ -737,12 +737,16 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
 	/* init elevator */
 	if (elevator_init(q, NULL)) {
 		mutex_unlock(&q->sysfs_lock);
-		return NULL;
+		goto fail;
 	}
 
 	mutex_unlock(&q->sysfs_lock);
 
 	return q;
+
+fail:
+	kfree(q->flush_rq);
+	return NULL;
 }
 EXPORT_SYMBOL(blk_init_allocated_queue);
Signature · 1 line
Jens Axboe