Manjunath Patil 4e6d30de2e xen-blkfront: fix kernel panic with negotiate_mq error path ...

commit 6cc4a0863c upstream.

info->nr_rings isn't adjusted in case of ENOMEM error from
negotiate_mq(). This leads to kernel panic in error path.

Typical call stack involving panic -
 #8 page_fault at ffffffff8175936f
    [exception RIP: blkif_free_ring+33]
    RIP: ffffffffa0149491  RSP: ffff8804f7673c08  RFLAGS: 00010292
 ...
 #9 blkif_free at ffffffffa0149aaa [xen_blkfront]
 #10 talk_to_blkback at ffffffffa014c8cd [xen_blkfront]
 #11 blkback_changed at ffffffffa014ea8b [xen_blkfront]
 #12 xenbus_otherend_changed at ffffffff81424670
 #13 backend_changed at ffffffff81426dc3
 #14 xenwatch_thread at ffffffff81422f29
 #15 kthread at ffffffff810abe6a
 #16 ret_from_fork at ffffffff81754078

Cc: stable@vger.kernel.org
Fixes: 7ed8ce1c5f ("xen-blkfront: move negotiate_mq to cover all cases of new VBDs")
Signed-off-by: Manjunath Patil <manjunath.b.patil@oracle.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-11-13 11:15:11 -08:00

..

aoe

block: don't set bounce limit in blk_init_queue

2017-06-27 12:13:45 -06:00

drbd

drbd: Fix drbd_request_prepare() discard handling

2018-08-24 13:09:09 +02:00

mtip32xx

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

paride

cdrom: do not call check_disk_change() inside cdrom_open()

2018-05-30 07:52:34 +02:00

rsxx

block: pass in queue to inflight accounting

2017-08-09 13:09:16 -06:00

xen-blkback

Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block

2017-09-07 11:59:42 -07:00

zram

drivers/block/zram/zram_drv.c: fix bug storing backing_dev

2018-09-09 19:55:58 +02:00

amiflop.c

block: introduce new block status code type

2017-06-09 09:27:32 -06:00

ataflop.c

ataflop: fix error handling during setup

2018-11-13 11:14:51 -08:00

brd.c

brd: fix overflow in __brd_direct_access

2017-09-25 08:56:05 -06:00

cryptoloop.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

DAC960.c

block: DAC960: shut up format-overflow warning

2017-07-29 09:00:03 -06:00

DAC960.h

Fix DAC960 driver on machines which don't support 64-bit DMA

2007-09-11 17:21:19 -07:00

floppy.c

floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl

2018-10-03 17:00:54 -07:00

Kconfig

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

loop.c

loop: remember whether sysfs_create_group() was done

2018-07-17 11:39:33 +02:00

loop.h

loop: remember whether sysfs_create_group() was done

2018-07-17 11:39:33 +02:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nbd.c

nbd: don't allow invalid blocksize settings

2018-09-19 22:43:35 +02:00

null_blk.c

block: null_blk: fix 'Invalid parameters' when loading module

2018-05-30 07:52:36 +02:00

pktcdvd.c

pktcdvd: Fix possible Spectre-v1 for pkt_devs

2018-09-19 22:43:43 +02:00

ps3disk.c

block: introduce new block status code type

2017-06-09 09:27:32 -06:00

ps3vram.c

block/ps3vram: Check return of ps3vram_cache_init

2017-08-17 23:03:44 +10:00

rbd_types.h

rbd: RBD_V{1,2}_DATA_FORMAT macros

2017-02-20 12:16:15 +01:00

rbd.c

rbd: flush rbd_dev->watch_dwork after watch is unregistered

2018-07-03 11:25:03 +02:00

skd_main.c

skd: Use kmem_cache_free

2017-10-09 08:31:27 -06:00

skd_s1120.h

skd: Use __packed only when needed

2017-08-18 08:45:29 -06:00

smart1,2.h

fix typos 'comamnd' -> 'command' in comments

2011-02-02 11:31:21 +01:00

sunvdc.c

sunvdc: prevent sunvdc panic when mpgroup disk added to guest domain

2017-08-09 22:22:32 -07:00

swim3.c

block/swim: Rename macros to avoid inconsistent inverted logic

2018-04-29 11:33:17 +02:00

swim_asm.S

m68k: mac - Add SWIM floppy support

2009-03-26 21:15:27 +01:00

swim.c

swim: fix cleanup on setup error

2018-11-13 11:14:52 -08:00

sx8.c

block: introduce new block status code type

2017-06-09 09:27:32 -06:00

umem.c

blk: remove bio_set arg from blk_queue_split()

2017-06-18 12:40:59 -06:00

umem.h

drivers/block/umem: trim trailing whitespace

2007-10-10 09:25:59 +02:00

virtio_blk.c

virtio_blk: Fix an SG_IO regression

2017-10-27 08:23:21 -06:00

xen-blkfront.c

xen-blkfront: fix kernel panic with negotiate_mq error path

2018-11-13 11:15:11 -08:00

xsysace.c

block: don't set bounce limit in blk_init_queue

2017-06-27 12:13:45 -06:00

z2ram.c

block: introduce new block status code type

2017-06-09 09:27:32 -06:00