blk-core: Fix memory corruption if blkcg_init_queue fails

[platform/adaptation/renesas_rcar/renesas_kernel.git] / block / blk-core.c

diff --git a/block/blk-core.c b/block/blk-core.c
index 0a00e4e..0c611d8 100644 (file)
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -645,10 +645,12 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id)
        __set_bit(QUEUE_FLAG_BYPASS, &q->queue_flags);
 
        if (blkcg_init_queue(q))
-               goto fail_id;
+               goto fail_bdi;
 
        return q;
 
+fail_bdi:
+       bdi_destroy(&q->backing_dev_info);
 fail_id:
        ida_simple_remove(&blk_queue_ida, q->id);
 fail_q:
@@ -2227,6 +2229,7 @@ void blk_start_request(struct request *req)
        if (unlikely(blk_bidi_rq(req)))
                req->next_rq->resid_len = blk_rq_bytes(req->next_rq);
 
+       BUG_ON(test_bit(REQ_ATOM_COMPLETE, &req->atomic_flags));
        blk_add_timer(req);
 }
 EXPORT_SYMBOL(blk_start_request);