[Devel] [PATCH RHEL7 COMMIT] ms/cfq-iosched: fix oom cfq_queue ref leak in cfq_set_request()

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-229.7.2.vz7.9.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-229.7.2.vz7.9.12
------>
commit ee8789d3904c8028a72612038cfeaef293205fde
Author: Tejun Heo <tj at kernel.org>
Date:   Mon Nov 23 19:30:37 2015 +0400

    ms/cfq-iosched: fix oom cfq_queue ref leak in cfq_set_request()
    
    If the cfq_queue cached in cfq_io_cq is the oom one, cfq_set_request()
    replaces it by invoking cfq_get_queue() again without putting the oom
    queue leaking the reference it was holding.  While oom queues are not
    released through reference counting, they're still reference counted
    and this can theoretically lead to the reference count overflowing and
    incorrectly invoke the usual release path on it.
    
    Fix it by making cfq_set_request() put the ref it was holding.
    
    Signed-off-by: Tejun Heo <tj at kernel.org>
    Acked-by: Jeff Moyer <jmoyer at redhat.com>
    Cc: Vivek Goyal <vgoyal at redhat.com>
    Cc: Arianna Avanzini <avanzini.arianna at gmail.com>
    Signed-off-by: Jens Axboe <axboe at fb.com>
    
    https://jira.sw.ru/browse/PSBM-41334
    
    (cherry picked from commit bce6133b09013f70d41a678d262a12147ed43889)
    Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
---
 block/cfq-iosched.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 911baae..27796ec 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -4264,6 +4264,8 @@ cfq_set_request(struct request_queue *q, struct request *rq, struct bio *bio,
 new_queue:
 	cfqq = cic_to_cfqq(cic, is_sync);
 	if (!cfqq || cfqq == &cfqd->oom_cfqq) {
+		if (cfqq)
+			cfq_put_queue(cfqq);
 		cfqq = cfq_get_queue(cfqd, is_sync, cic, bio);
 		cic_set_cfqq(cic, cfqq, is_sync);
 	} else {