linux-kernel - [PATCH 2/2] virtio-blk: Ensure no requests in virtqueues before deleting vqs.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 22 Jan 2024 19:07:22 +0800
From: Yi Sun <yi.sun@...soc.com>
To: <axboe@...nel.dk>, <mst@...hat.com>, <jasowang@...hat.com>
CC: <xuanzhuo@...ux.alibaba.com>, <pbonzini@...hat.com>, <stefanha@...hat.com>,
        <virtualization@...ts.linux.dev>, <linux-block@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <yi.sun@...soc.com>,
        <zhiguo.niu@...soc.com>, <hongyu.jin@...soc.com>,
        <sunyibuaa@...il.com>
Subject: [PATCH 2/2] virtio-blk: Ensure no requests in virtqueues before deleting vqs.

Ensure no remaining requests in virtqueues before resetting vdev and
deleting virtqueues. Otherwise these requests will never be completed.
It may cause the system to become unresponsive. So it is better to place
blk_mq_quiesce_queue() in front of virtio_reset_device().

Function blk_mq_quiesce_queue() can ensure that requests have become
in_flight status, but it cannot guarantee that requests have been
processed by the device. Virtqueues should never be deleted before
all requests become complete status.

New function blk_mq_tagset_wait_request_completed() ensure that all
requests in virtqueues become complete status.

Signed-off-by: Yi Sun <yi.sun@...soc.com>
---
 drivers/block/virtio_blk.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 3b6b9abb8ce1..380f009953dd 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -1595,14 +1595,16 @@ static int virtblk_freeze(struct virtio_device *vdev)
 {
 	struct virtio_blk *vblk = vdev->priv;

+	/* Ensure no requests in virtqueues before deleting vqs. */
+	blk_mq_quiesce_queue(vblk->disk->queue);
+	blk_mq_tagset_wait_request_completed(vblk->disk->queue->tag_set);
+
 	/* Ensure we don't receive any more interrupts */
 	virtio_reset_device(vdev);

 	/* Make sure no work handler is accessing the device. */
 	flush_work(&vblk->config_work);

-	blk_mq_quiesce_queue(vblk->disk->queue);
-
 	vdev->config->del_vqs(vdev);
 	kfree(vblk->vqs);

-- 
2.25.1