Mikulas Patocka d8db1a5f31 blk-core: Fix memory corruption if blkcg_init_queue fails ... commit fff4996b7db7955414ac74386efa5e07fd766b50 upstream. If blkcg_init_queue fails, blk_alloc_queue_node doesn't call bdi_destroy to clean up structures allocated by the backing dev. ------------[ cut here ]------------ WARNING: at lib/debugobjects.c:260 debug_print_object+0x85/0xa0() ODEBUG: free active (active state 0) object type: percpu_counter hint: (null) Modules linked in: dm_loop dm_mod ip6table_filter ip6_tables uvesafb cfbcopyarea cfbimgblt cfbfillrect fbcon font bitblit fbcon_rotate fbcon_cw fbcon_ud fbcon_ccw softcursor fb fbdev ipt_MASQUERADE iptable_nat nf_nat_ipv4 msr nf_conntrack_ipv4 nf_defrag_ipv4 xt_state ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge stp llc tun ipv6 cpufreq_userspace cpufreq_stats cpufreq_powersave cpufreq_ondemand cpufreq_conservative spadfs fuse hid_generic usbhid hid raid0 md_mod dmi_sysfs nf_nat_ftp nf_nat nf_conntrack_ftp nf_conntrack lm85 hwmon_vid snd_usb_audio snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc snd_hwdep snd_usbmidi_lib snd_rawmidi snd soundcore acpi_cpufreq freq_table mperf sata_svw serverworks kvm_amd ide_core ehci_pci ohci_hcd libata ehci_hcd kvm usbcore tg3 usb_common libphy k10temp pcspkr ptp i2c_piix4 i2c_core evdev microcode hwmon rtc_cmos pps_core e100 skge floppy mii processor button unix CPU: 0 PID: 2739 Comm: lvchange Tainted: G W 3.10.15-devel #14 Hardware name: empty empty/S3992-E, BIOS 'V1.06 ' 06/09/2009 0000000000000009 ffff88023c3c1ae8 ffffffff813c8fd4 ffff88023c3c1b20 ffffffff810399eb ffff88043d35cd58 ffffffff81651940 ffff88023c3c1bf8 ffffffff82479d90 0000000000000005 ffff88023c3c1b80 ffffffff81039a67 Call Trace: [<ffffffff813c8fd4>] dump_stack+0x19/0x1b [<ffffffff810399eb>] warn_slowpath_common+0x6b/0xa0 [<ffffffff81039a67>] warn_slowpath_fmt+0x47/0x50 [<ffffffff8122aaaf>] ? debug_check_no_obj_freed+0xcf/0x250 [<ffffffff81229a15>] debug_print_object+0x85/0xa0 [<ffffffff8122abe3>] debug_check_no_obj_freed+0x203/0x250 [<ffffffff8113c4ac>] kmem_cache_free+0x20c/0x3a0 [<ffffffff811f6709>] blk_alloc_queue_node+0x2a9/0x2c0 [<ffffffff811f672e>] blk_alloc_queue+0xe/0x10 [<ffffffffa04c0093>] dm_create+0x1a3/0x530 [dm_mod] [<ffffffffa04c6bb0>] ? list_version_get_info+0xe0/0xe0 [dm_mod] [<ffffffffa04c6c07>] dev_create+0x57/0x2b0 [dm_mod] [<ffffffffa04c6bb0>] ? list_version_get_info+0xe0/0xe0 [dm_mod] [<ffffffffa04c6bb0>] ? list_version_get_info+0xe0/0xe0 [dm_mod] [<ffffffffa04c6528>] ctl_ioctl+0x268/0x500 [dm_mod] [<ffffffff81097662>] ? get_lock_stats+0x22/0x70 [<ffffffffa04c67ce>] dm_ctl_ioctl+0xe/0x20 [dm_mod] [<ffffffff81161aad>] do_vfs_ioctl+0x2ed/0x520 [<ffffffff8116cfc7>] ? fget_light+0x377/0x4e0 [<ffffffff81161d2b>] SyS_ioctl+0x4b/0x90 [<ffffffff813cff16>] system_call_fastpath+0x1a/0x1f ---[ end trace 4b5ff0d55673d986 ]--- ------------[ cut here ]------------ This fix should be backported to stable kernels starting with 2.6.37. Note that in the kernels prior to 3.5 the affected code is different, but the bug is still there - bdi_init is called and bdi_destroy isn't. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2013-12-04 10:56:46 -08:00
..
partitions	partitions/efi.c: replace useless kzalloc's by kmalloc's	2013-04-30 08:34:25 +02:00
blk-cgroup.c	blkcg: fix "scheduling while atomic" in blk_queue_bypass_start	2013-04-09 15:01:21 +02:00
blk-cgroup.h	cgroup: fix cgroup_path() vs rename() race	2013-03-04 09:50:08 -08:00
blk-core.c	blk-core: Fix memory corruption if blkcg_init_queue fails	2013-12-04 10:56:46 -08:00
blk-exec.c	Merge branch 'for-3.9/core' of git://git.kernel.dk/linux-block	2013-02-28 12:52:24 -08:00
blk-flush.c	Block: blk-flush: Fixed indent code style	2013-03-22 12:22:51 -06:00
blk-integrity.c	scatterlist: introduce sg_unmark_end	2013-03-20 15:43:04 +10:30
blk-ioc.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
blk-iopoll.c
blk-lib.c	block: account iowait time when waiting for completion of IO request	2013-02-15 16:45:07 +01:00
blk-map.c
blk-merge.c	scatterlist: introduce sg_unmark_end	2013-03-20 15:43:04 +10:30
blk-settings.c	block: properly stack underlying max_segment_size to DM device	2013-11-29 11:11:51 -08:00
blk-softirq.c
blk-sysfs.c	block: avoid using uninitialized value in from queue_var_store	2013-04-03 21:53:57 +02:00
blk-tag.c
blk-throttle.c
blk-timeout.c	block: fix race between request completion and timeout handling	2013-11-29 11:11:50 -08:00
blk.h	block,elevator: use new hashtable implementation	2013-01-11 14:43:13 +01:00
bsg-lib.c
bsg.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
cfq-iosched.c	cfq: explicitly use 64bit divide operation for 64bit arguments	2013-10-01 09:17:48 -07:00
compat_ioctl.c
deadline-iosched.c	elevator: Fix a race in elevator switching	2013-08-20 08:43:03 -07:00
elevator.c	elevator: Fix a race in elevator switching	2013-08-20 08:43:03 -07:00
genhd.c	block: do not pass disk names as format strings	2013-07-13 11:42:26 -07:00
ioctl.c
Kconfig	block: don't select PERCPU_RWSEM	2013-02-22 10:42:45 +01:00
Kconfig.iosched
Makefile
noop-iosched.c	elevator: Fix a race in elevator switching	2013-08-20 08:43:03 -07:00
partition-generic.c	Revert "loop: cleanup partitions when detaching loop device"	2013-04-08 10:12:11 +02:00
scsi_ioctl.c	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00