linux-kernel - Re: [PATCH] blk-mq: avoid potential infinite loop in __blk_mq_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <eb99b420-3e28-98c7-dacc-767d564661e2@linux.alibaba.com>
Date:   Fri, 22 Jul 2022 16:15:49 +0800
From:   Liu Song <liusong@...ux.alibaba.com>
To:     Christoph Hellwig <hch@...radead.org>
Cc:     axboe@...nel.dk, linux-block@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] blk-mq: avoid potential infinite loop in
 __blk_mq_alloc_request

> On Fri, Jul 22, 2022 at 01:22:23PM +0800, Liu Song wrote:
>> From: Liu Song <liusong@...ux.alibaba.com>
>>
>> If "blk_mq_get_tag" returns BLK_MQ_NO_TAG because the value of
>> "tags->nr_reserved_tags" is 0, it will fall into an infinite loop in
>> "__blk_mq_alloc_requests", so borrow BLK_MQ_REQ_NOWAIT to exit the loop.
> That means the driver calling blk_mq_alloc_request has a bug, and
> we should not work round that in the low level tag allocation path.
>
> If we want to be nice we can add a WARN_ON before going all the way
> down into the tag allocator, something like:
>
> diff --git a/block/blk-mq.c b/block/blk-mq.c
> index 92aae03103b74..d6c7e2ece025f 100644
> --- a/block/blk-mq.c
> +++ b/block/blk-mq.c
> @@ -520,6 +520,10 @@ struct request *blk_mq_alloc_request(struct request_queue *q, unsigned int op,
>   	struct request *rq;
>   	int ret;
>   
> +	if (WARN_ON_ONCE((flags & BLK_MQ_REQ_RESERVED) &&
> +			!q->tag_set->reserved_tags))
> +		return ERR_PTR(-EINVAL);
> +

Hi，

It is a reasonable approach to prevent abnormal alloc from going down,
but this is a very rare exception after all, and above modification is 
checked
every alloc request, which seems to be a bit excessive overhead.

After the rare exception occurs and fix it, the impact on the alloc 
request will be lower.

Thanks

>   	ret = blk_queue_enter(q, flags);
>   	if (ret)
>   		return ERR_PTR(ret);