As part of blk_mq_realloc_hw_ctx(), if the init_hctx() ops is failed by the underyling transport, the hctx pointer is freed and initialized to NULL. However, functions down the line, access this hwctx pointer without a NULL pointer check, which could lead to a kernel crash. Signed-off-by: Somnath Kotur <somnath.kotur@xxxxxxxxxxxx> Signed-off-by: Jitendra Bhivare <jitendra.bhivare@xxxxxxxxxxxx> --- block/blk-mq.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/block/blk-mq.c b/block/blk-mq.c index a4546f0..9cb2d2e 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2048,6 +2048,8 @@ static void blk_mq_init_cpu_queues(struct request_queue *q, continue; hctx = blk_mq_map_queue(q, i); + if (!hctx) + continue; /* * Set local node, IFF we have more than one hw queue. If @@ -2128,6 +2130,8 @@ static void blk_mq_map_swqueue(struct request_queue *q, ctx = per_cpu_ptr(q->queue_ctx, i); hctx = blk_mq_map_queue(q, i); + if (!hctx) + continue; cpumask_set_cpu(i, hctx->cpumask); ctx->index_hw = hctx->nr_ctx; -- 1.8.3.1
