[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Y4fCE7XxcpDfWyDJ@slm.duckdns.org>
Date: Wed, 30 Nov 2022 10:50:27 -1000
From: Tejun Heo <tj@...nel.org>
To: Li Nan <linan122@...wei.com>
Cc: josef@...icpanda.com, axboe@...nel.dk, cgroups@...r.kernel.org,
linux-block@...r.kernel.org, linux-kernel@...r.kernel.org,
yukuai3@...wei.com, yi.zhang@...wei.com
Subject: Re: [PATCH -next v2 8/9] block: fix null-pointer dereference in
ioc_pd_init
On Wed, Nov 30, 2022 at 09:21:55PM +0800, Li Nan wrote:
> Remove block device when iocost is initializing may cause
> null-pointer dereference:
>
> CPU1 CPU2
> ioc_qos_write
> blkcg_conf_open_bdev
> blkdev_get_no_open
> kobject_get_unless_zero
> blk_iocost_init
> rq_qos_add
> del_gendisk
> rq_qos_exit
> q->rq_qos = rqos->next
> //iocost is removed from q->roqs
> blkcg_activate_policy
> pd_init_fn
> ioc_pd_init
> ioc = q_to_ioc(blkg->q)
> //cant find iocost and return null
>
> Fix problem by moving rq_qos_exit() to disk_release(). ioc_qos_write() get
> bd_device.kobj in blkcg_conf_open_bdev(), so disk_release will not be
> actived until iocost initialization is complited.
I think it'd be better to make del_gendisk wait for these in-flight
operations because this might fix the above particular issue but now all the
policies are exposed to request_queue in a state it never expected before.
del_gendisk() is quiescing the queue around rq_qos_exit(), so maybe we can
piggyback on that and update blkcg_conf_open_bdev() to provide such
exclusion?
Thanks.
--
tejun
Powered by blists - more mailing lists