| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 9 Jul 2015 23:25:32 +0900
From: Akinobu Mita <akinobu.mita@...il.com>
To: Ming Lei <tom.leiming@...il.com>
Cc: Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
Jens Axboe <axboe@...nel.dk>
Subject: Re: [PATCH v2 1/6] blk-mq: fix sysfs registration/unregistration race
Hi Ming,
2015-07-08 20:48 GMT+09:00 Ming Lei <tom.leiming@...il.com>:
> On Thu, Jul 2, 2015 at 10:29 PM, Akinobu Mita <akinobu.mita@...il.com> wrote:
>> There is a race between cpu hotplug handling and adding/deleting
>> gendisk for blk-mq, where both are trying to register and unregister
>> the same sysfs entries.
>>
>> CPU hotplug handling for blk-mq (blk_mq_queue_reinit) does unregister
>> and register sysfs entries of hctx for all request queues in
>> all_q_list. On the other hand, these entries for a request queue may
>> have already been unregistered or in the middle of registration when
>> CPU hotplug event occurs. Because those sysfs entries are registered
>> by blk_mq_register_disk() after the request queue is added to
>> all_q_list, and similarily the request queue is deleted from
>> all_q_list after those are unregistered by blk_mq_unregister_disk().
>>
>> So we need proper mutual exclusion for those registration and
>> unregistration.
>
> But that may not be enough, and you miss another point in which
> blk_mq_sysfs_register() has to be called after the remapping is built,
> so the introduced lock should have been held in blk_mq_queue_reinit().
OK.
Although q->mq_sysfs_lock is held in blk_mq_sysfs_register() by
this patch, it should be held in blk_mq_queue_reinit() as you
suggested. Since hctx->nr_ctx is reset temporarily in
blk_mq_map_swqueue() while cpu hotplug callback is called, so we
should avoid blk_mq_register_disk() seeing the temporary
hctx->nr_ctx value (i.e. zero) at the same time by holding
q->mq_sysfs_lock in blk_mq_queue_reinit().
>> Signed-off-by: Akinobu Mita <akinobu.mita@...il.com>
>> Cc: Jens Axboe <axboe@...nel.dk>
>> Cc: Ming Lei <tom.leiming@...il.com>
>> ---
>> block/blk-core.c | 1 +
>> block/blk-mq-sysfs.c | 44 ++++++++++++++++++++++++++++++++++----------
>> include/linux/blkdev.h | 3 +++
>> 3 files changed, 38 insertions(+), 10 deletions(-)
>>
>> diff --git a/block/blk-core.c b/block/blk-core.c
>> index 82819e6..bbf67cd 100644
>> --- a/block/blk-core.c
>> +++ b/block/blk-core.c
>> @@ -687,6 +687,7 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id)
>> __set_bit(QUEUE_FLAG_BYPASS, &q->queue_flags);
>>
>> init_waitqueue_head(&q->mq_freeze_wq);
>> + mutex_init(&q->mq_sysfs_lock);
>
> The above should be put into blk_mq_init_allocated_queue().
OK, make sense.
>>
>> if (blkcg_init_queue(q))
>> goto fail_bdi;
>> diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
>> index b79685e..79a3e8d 100644
>> --- a/block/blk-mq-sysfs.c
>> +++ b/block/blk-mq-sysfs.c
>> @@ -332,13 +332,15 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
>> struct blk_mq_ctx *ctx;
>> int i;
>>
>> - if (!hctx->nr_ctx || !(hctx->flags & BLK_MQ_F_SYSFS_UP))
>> + if (!(hctx->flags & BLK_MQ_F_SYSFS_UP))
>> return;
>
> It isn't needed to introduce above change.
>
>>
>> hctx_for_each_ctx(hctx, ctx, i)
>> kobject_del(&ctx->kobj);
>>
>> kobject_del(&hctx->kobj);
>> +
>> + hctx->flags &= ~BLK_MQ_F_SYSFS_UP;
>
> I guess you misunderstand the flag, which just means the syfs stuff
> for the hcts has been setup, and you needn't clear it.
I've changed the meaning of the flag which should have been
mentioned and also introduced q->mq_sysfs_init_done. So I admit
that the code has become much complicated.
But after consideration, I think we can only need q->mq_sysfs_init_done
and BLK_MQ_F_SYSFS_UP can be removed. Please see below.
>> }
>>
>> static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
>> @@ -347,7 +349,7 @@ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
>> struct blk_mq_ctx *ctx;
>> int i, ret;
>>
>> - if (!hctx->nr_ctx || !(hctx->flags & BLK_MQ_F_SYSFS_UP))
>> + if (!hctx->nr_ctx)
>> return 0;
>>
>> ret = kobject_add(&hctx->kobj, &q->mq_kobj, "%u", hctx->queue_num);
>> @@ -357,10 +359,12 @@ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
>> hctx_for_each_ctx(hctx, ctx, i) {
>> ret = kobject_add(&ctx->kobj, &hctx->kobj, "cpu%u", ctx->cpu);
>> if (ret)
>> - break;
>> + return ret;
>> }
>>
>> - return ret;
>> + hctx->flags |= BLK_MQ_F_SYSFS_UP;
>
> Same with above.
>
>> +
>> + return 0;
>> }
>>
>> void blk_mq_unregister_disk(struct gendisk *disk)
>> @@ -370,6 +374,8 @@ void blk_mq_unregister_disk(struct gendisk *disk)
>> struct blk_mq_ctx *ctx;
>> int i, j;
>>
>> + mutex_lock(&q->mq_sysfs_lock);
>> +
>> queue_for_each_hw_ctx(q, hctx, i) {
>> blk_mq_unregister_hctx(hctx);
>>
>> @@ -384,6 +390,9 @@ void blk_mq_unregister_disk(struct gendisk *disk)
>> kobject_put(&q->mq_kobj);
>>
>> kobject_put(&disk_to_dev(disk)->kobj);
>> +
>> + q->mq_sysfs_init_done = false;
>
> The flag isn't needed, but you should hold q->mq_sysfs_lock
> inside blk_mq_queue_reinit().
The reason for q->mq_sysfs_init_done is to avoid the following
scenario.
While the request queue is added to 'all_q_list' (*),
blk_mq_queue_reinit() can be called for the queue anytime by CPU
hotplug callback. But blk_mq_sysfs_unregister (-) and
blk_mq_sysfs_register (+) in blk_mq_queue_reinit must not be
called before blk_mq_register_disk (++) is finished and after
blk_mq_unregister_disk (--). Because '/sys/block/nullb*/mq/' is
not exists.
BLK_MQ_F_SYSFS_UP flag in hctx->flags fixes this issue partially now.
In order to fix it completely, we just need q->mq_sysfs_init_done
instead of per hctx flag with appropriate locking.
null_add_dev
--> blk_mq_init_queue
--> blk_mq_init_allocated_queue
--> add to 'all_q_list' (*)
--> add_disk
--> blk_register_queue
--> blk_mq_register_disk (++)
null_del_dev
--> del_gendisk
--> blk_unregister_queue
--> blk_mq_unregister_disk (--)
--> blk_cleanup_queue
--> blk_mq_free_queue
--> del from 'all_q_list' (*)
blk_mq_queue_reinit
--> blk_mq_sysfs_unregister (-)
--> blk_mq_sysfs_register (+)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists