From: Christoph Hellwig hch@lst.de
[ Upstream commit 40602997be26887bdfa3d58659c3acb4579099e9 ]
blk_register_queue fails to handle errors from blk_mq_sysfs_register, leaks various resources on errors and accidentally sets queue refs percpu refcount to percpu mode on kobject_add failure. Fix all that by properly unwinding on errors.
Signed-off-by: Christoph Hellwig hch@lst.de Link: https://lore.kernel.org/r/20221114042637.1009333-4-hch@lst.de Signed-off-by: Jens Axboe axboe@kernel.dk Stable-dep-of: d36a9ea5e776 ("block: fix use-after-free of q->q_usage_counter") Signed-off-by: Sasha Levin sashal@kernel.org --- block/blk-sysfs.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-)
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index 4825eaa4363a..02931b6f25c5 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -820,13 +820,15 @@ int blk_register_queue(struct gendisk *disk) int ret;
mutex_lock(&q->sysfs_dir_lock); - ret = kobject_add(&q->kobj, &disk_to_dev(disk)->kobj, "queue"); if (ret < 0) - goto unlock; + goto out_unlock_dir;
- if (queue_is_mq(q)) - blk_mq_sysfs_register(disk); + if (queue_is_mq(q)) { + ret = blk_mq_sysfs_register(disk); + if (ret) + goto out_del_queue_kobj; + } mutex_lock(&q->sysfs_lock);
mutex_lock(&q->debugfs_mutex); @@ -838,17 +840,17 @@ int blk_register_queue(struct gendisk *disk)
ret = disk_register_independent_access_ranges(disk); if (ret) - goto put_dev; + goto out_debugfs_remove;
if (q->elevator) { ret = elv_register_queue(q, false); if (ret) - goto put_dev; + goto out_unregister_ia_ranges; }
ret = blk_crypto_sysfs_register(disk); if (ret) - goto put_dev; + goto out_elv_unregister;
blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q); wbt_enable_default(q); @@ -859,8 +861,6 @@ int blk_register_queue(struct gendisk *disk) if (q->elevator) kobject_uevent(&q->elevator->kobj, KOBJ_ADD); mutex_unlock(&q->sysfs_lock); - -unlock: mutex_unlock(&q->sysfs_dir_lock);
/* @@ -879,13 +879,17 @@ int blk_register_queue(struct gendisk *disk)
return ret;
-put_dev: +out_elv_unregister: elv_unregister_queue(q); +out_unregister_ia_ranges: disk_unregister_independent_access_ranges(disk); +out_debugfs_remove: + blk_debugfs_remove(disk); mutex_unlock(&q->sysfs_lock); - mutex_unlock(&q->sysfs_dir_lock); +out_del_queue_kobj: kobject_del(&q->kobj); - +out_unlock_dir: + mutex_unlock(&q->sysfs_dir_lock); return ret; }