linux-kernel - Re: [PATCH] blk-mq: don't complete un-started request in timeout handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2bc8118b-4a11-f28e-50eb-22019184756b@fb.com>
Date:   Tue, 21 Mar 2017 23:03:59 -0400
From:   Jens Axboe <axboe@...com>
To:     Ming Lei <tom.leiming@...il.com>, <linux-kernel@...r.kernel.org>,
        <linux-block@...r.kernel.org>,
        Christoph Hellwig <hch@...radead.org>
CC:     Yi Zhang <yizhan@...hat.com>,
        Bart Van Assche <bart.vanassche@...disk.com>,
        Hannes Reinecke <hare@...e.de>,
        Keith Busch <keith.busch@...el.com>
Subject: Re: [PATCH] blk-mq: don't complete un-started request in timeout
 handler

On 03/21/2017 10:14 PM, Ming Lei wrote:
> When iterating busy requests in timeout handler,
> if the STARTED flag of one request isn't set, that means
> the request is being processed in block layer or driver, and
> isn't submitted to hardware yet.
> 
> In current implementation of blk_mq_check_expired(),
> if the request queue becomes dying, un-started requests are
> handled as being completed/freed immediately. This way is
> wrong, and can cause rq corruption or double allocation[1][2],
> when doing I/O and removing&resetting NVMe device at the sametime.

I agree, completing it looks bogus. If the request is in a scheduler or
on a software queue, this won't end well at all. Looks like it was
introduced by this patch:

commit eb130dbfc40eabcd4e10797310bda6b9f6dd7e76
Author: Keith Busch <keith.busch@...el.com>
Date:   Thu Jan 8 08:59:53 2015 -0700

    blk-mq: End unstarted requests on a dying queue

Before that, we just ignored it. Keith?

-- 
Jens Axboe