Re: [PATCH] blk-mq-sched: Fix blk_mq_sched_alloc_tags() error handling

On Tue, Jul 27, 2021 at 11:30:00AM +0100, John Garry wrote:

On 27/07/2021 11:06, Ming Lei wrote:

quoted

On Tue, Jul 27, 2021 at 05:32:53PM +0800, John Garry wrote:

quoted

If the blk_mq_sched_alloc_tags() -> blk_mq_alloc_rqs() call fails, then we
call blk_mq_sched_free_tags() -> blk_mq_free_rqs().

It is incorrect to do so, as any rqs would have already been freed in the
blk_mq_alloc_rqs() call.

Fix by calling blk_mq_free_rq_map() only directly.

Fixes: 6917ff0b5bd41 ("blk-mq-sched: refactor scheduler initialization")
Signed-off-by: John Garry <redacted>

Not sure it is one fix, because blk_mq_free_rqs() does nothing when
->static_rqs[] isn't filled, so 'Fixes' tag isn't needed, IMO.

I actually experimented by returning an error from blk_mq_sched_alloc_tags()
-> blk_mq_alloc_rqs() at the function entry point, and it crashes:

[8.118419]
==================================================================
[8.125677] BUG: KASAN: null-ptr-deref in blk_mq_free_rqs+0x170/0x380

OK, looks it is caused by un-initialized &tags->page_list, then it is fine
to mark it as fixes.

-- 
Ming