Mikulas Patocka fff4996b7d blk-core: Fix memory corruption if blkcg_init_queue fails ... If blkcg_init_queue fails, blk_alloc_queue_node doesn't call bdi_destroy to clean up structures allocated by the backing dev. ------------[ cut here ]------------ WARNING: at lib/debugobjects.c:260 debug_print_object+0x85/0xa0() ODEBUG: free active (active state 0) object type: percpu_counter hint: (null) Modules linked in: dm_loop dm_mod ip6table_filter ip6_tables uvesafb cfbcopyarea cfbimgblt cfbfillrect fbcon font bitblit fbcon_rotate fbcon_cw fbcon_ud fbcon_ccw softcursor fb fbdev ipt_MASQUERADE iptable_nat nf_nat_ipv4 msr nf_conntrack_ipv4 nf_defrag_ipv4 xt_state ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge stp llc tun ipv6 cpufreq_userspace cpufreq_stats cpufreq_powersave cpufreq_ondemand cpufreq_conservative spadfs fuse hid_generic usbhid hid raid0 md_mod dmi_sysfs nf_nat_ftp nf_nat nf_conntrack_ftp nf_conntrack lm85 hwmon_vid snd_usb_audio snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc snd_hwdep snd_usbmidi_lib snd_rawmidi snd soundcore acpi_cpufreq freq_table mperf sata_svw serverworks kvm_amd ide_core ehci_pci ohci_hcd libata ehci_hcd kvm usbcore tg3 usb_common libphy k10temp pcspkr ptp i2c_piix4 i2c_core evdev microcode hwmon rtc_cmos pps_core e100 skge floppy mii processor button unix CPU: 0 PID: 2739 Comm: lvchange Tainted: G W 3.10.15-devel #14 Hardware name: empty empty/S3992-E, BIOS 'V1.06 ' 06/09/2009 0000000000000009 ffff88023c3c1ae8 ffffffff813c8fd4 ffff88023c3c1b20 ffffffff810399eb ffff88043d35cd58 ffffffff81651940 ffff88023c3c1bf8 ffffffff82479d90 0000000000000005 ffff88023c3c1b80 ffffffff81039a67 Call Trace: [<ffffffff813c8fd4>] dump_stack+0x19/0x1b [<ffffffff810399eb>] warn_slowpath_common+0x6b/0xa0 [<ffffffff81039a67>] warn_slowpath_fmt+0x47/0x50 [<ffffffff8122aaaf>] ? debug_check_no_obj_freed+0xcf/0x250 [<ffffffff81229a15>] debug_print_object+0x85/0xa0 [<ffffffff8122abe3>] debug_check_no_obj_freed+0x203/0x250 [<ffffffff8113c4ac>] kmem_cache_free+0x20c/0x3a0 [<ffffffff811f6709>] blk_alloc_queue_node+0x2a9/0x2c0 [<ffffffff811f672e>] blk_alloc_queue+0xe/0x10 [<ffffffffa04c0093>] dm_create+0x1a3/0x530 [dm_mod] [<ffffffffa04c6bb0>] ? list_version_get_info+0xe0/0xe0 [dm_mod] [<ffffffffa04c6c07>] dev_create+0x57/0x2b0 [dm_mod] [<ffffffffa04c6bb0>] ? list_version_get_info+0xe0/0xe0 [dm_mod] [<ffffffffa04c6bb0>] ? list_version_get_info+0xe0/0xe0 [dm_mod] [<ffffffffa04c6528>] ctl_ioctl+0x268/0x500 [dm_mod] [<ffffffff81097662>] ? get_lock_stats+0x22/0x70 [<ffffffffa04c67ce>] dm_ctl_ioctl+0xe/0x20 [dm_mod] [<ffffffff81161aad>] do_vfs_ioctl+0x2ed/0x520 [<ffffffff8116cfc7>] ? fget_light+0x377/0x4e0 [<ffffffff81161d2b>] SyS_ioctl+0x4b/0x90 [<ffffffff813cff16>] system_call_fastpath+0x1a/0x1f ---[ end trace 4b5ff0d55673d986 ]--- ------------[ cut here ]------------ This fix should be backported to stable kernels starting with 2.6.37. Note that in the kernels prior to 3.5 the affected code is different, but the bug is still there - bdi_init is called and bdi_destroy isn't. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Acked-by: Tejun Heo <tj@kernel.org> Cc: stable@kernel.org # 2.6.37+ Signed-off-by: Jens Axboe <axboe@kernel.dk>		2013-11-08 08:59:17 -07:00
..
partitions	block/partitions/efi.c: treat size mismatch as a warning, not an error	2013-10-16 21:35:53 -07:00
blk-cgroup.c	Merge branch 'for-3.12/core' of git://git.kernel.dk/linux-block	2013-09-22 15:00:11 -07:00
blk-cgroup.h	cgroup: make css_for_each_descendant() and friends include the origin css in the iteration	2013-08-08 20:11:27 -04:00
blk-core.c	blk-core: Fix memory corruption if blkcg_init_queue fails	2013-11-08 08:59:17 -07:00
blk-exec.c	If the queue is dying then we only call the rq->end_io callout.	2013-09-18 08:33:55 -06:00
blk-flush.c	Block: blk-flush: Fixed indent code style	2013-03-22 12:22:51 -06:00
blk-integrity.c	scatterlist: introduce sg_unmark_end	2013-03-20 15:43:04 +10:30
blk-ioc.c	lib/radix-tree.c: make radix_tree_node_alloc() work correctly within interrupt	2013-09-11 15:59:36 -07:00
blk-iopoll.c	block: delete __cpuinit usage from all block files	2013-07-14 19:36:59 -04:00
blk-lib.c	block: account iowait time when waiting for completion of IO request	2013-02-15 16:45:07 +01:00
blk-map.c	block: re-use existing 'reading' variable instead of checking direction again	2011-12-21 15:27:24 +01:00
blk-merge.c	scatterlist: introduce sg_unmark_end	2013-03-20 15:43:04 +10:30
blk-settings.c	block: discard granularity might not be power of 2	2012-12-14 20:46:04 +01:00
blk-softirq.c	block: delete __cpuinit usage from all block files	2013-07-14 19:36:59 -04:00
blk-sysfs.c	block/blk-sysfs.c: replace strict_strtoul() with kstrtoul()	2013-09-11 15:56:56 -07:00
blk-tag.c	block: Reserve only one queue tag for sync IO if only 3 tags are available	2013-06-28 21:32:27 +02:00
blk-throttle.c	cgroup: make css_for_each_descendant() and friends include the origin css in the iteration	2013-08-08 20:11:27 -04:00
blk-timeout.c	block: fix race between request completion and timeout handling	2013-11-08 08:59:04 -07:00
blk.h	block,elevator: use new hashtable implementation	2013-01-11 14:43:13 +01:00
bsg-lib.c	bsg: Remove unused function bsg_goose_queue()	2012-12-06 14:33:02 +01:00
bsg.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
cfq-iosched.c	Merge branch 'for-3.12/core' of git://git.kernel.dk/linux-block	2013-09-22 15:00:11 -07:00
cmdline-parser.c	block: support embedded device command line partition	2013-09-11 15:56:57 -07:00
compat_ioctl.c	kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user()	2013-09-11 15:58:18 -07:00
deadline-iosched.c	block: Convert kmalloc_node(...GFP_ZERO...) to kzalloc_node(...)	2013-09-11 13:22:03 -06:00
elevator.c	block: Convert kmalloc_node(...GFP_ZERO...) to kzalloc_node(...)	2013-09-11 13:22:03 -06:00
genhd.c	block: Convert kmalloc_node(...GFP_ZERO...) to kzalloc_node(...)	2013-09-11 13:22:03 -06:00
ioctl.c	Merge branch 'for-3.7/core' of git://git.kernel.dk/linux-block	2012-10-11 09:04:23 +09:00
Kconfig	block: change config option name for cmdline partition parsing	2013-09-30 14:31:02 -07:00
Kconfig.iosched	blkcg: make CONFIG_BLK_CGROUP bool	2012-03-06 21:27:21 +01:00
Makefile	block: change config option name for cmdline partition parsing	2013-09-30 14:31:02 -07:00
noop-iosched.c	elevator: Fix a race in elevator switching	2013-07-03 13:25:24 +02:00
partition-generic.c	Revert "loop: cleanup partitions when detaching loop device"	2013-04-08 10:12:11 +02:00
scsi_ioctl.c	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00