tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

blk-ioc: protect ioc_destroy_icq() by 'queue_lock'

Currently, icq is tracked by both request_queue(icq->q_node) and
task(icq->ioc_node), and ioc_clear_queue() from elevator exit is not
safe because it can access the list without protection:

ioc_clear_queue ioc_release_fn
lock queue_lock
list_splice
/* move queue list to a local list */
unlock queue_lock
/*
* lock is released, the local list
* can be accessed through task exit.
*/

lock ioc->lock
while (!hlist_empty)
icq = hlist_entry
lock queue_lock
ioc_destroy_icq
delete icq->ioc_node
while (!list_empty)
icq = list_entry() list_del icq->q_node
/*
* This is not protected by any lock,
* list_entry concurrent with list_del
* is not safe.
*/

unlock queue_lock
unlock ioc->lock

Fix this problem by protecting list 'icq->q_node' by queue_lock from
ioc_clear_queue().

Reported-and-tested-by: Pradeep Pragallapati <quic_pragalla@quicinc.com>
Link: https://lore.kernel.org/lkml/20230517084434.18932-1-quic_pragalla@quicinc.com/
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20230531073435.2923422-1-yukuai1@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

authored by

Yu Kuai and committed by
Jens Axboe 5a0ac57c 6c500000

+13 -17
+13 -17
block/blk-ioc.c
··· 77 77 struct elevator_type *et = q->elevator->type; 78 78 79 79 lockdep_assert_held(&ioc->lock); 80 + lockdep_assert_held(&q->queue_lock); 81 + 82 + if (icq->flags & ICQ_DESTROYED) 83 + return; 80 84 81 85 radix_tree_delete(&ioc->icq_tree, icq->q->id); 82 86 hlist_del_init(&icq->ioc_node); ··· 132 128 spin_lock(&q->queue_lock); 133 129 spin_lock(&ioc->lock); 134 130 135 - /* 136 - * The icq may have been destroyed when the ioc lock 137 - * was released. 138 - */ 139 - if (!(icq->flags & ICQ_DESTROYED)) 140 - ioc_destroy_icq(icq); 131 + ioc_destroy_icq(icq); 141 132 142 133 spin_unlock(&q->queue_lock); 143 134 rcu_read_unlock(); ··· 170 171 */ 171 172 void ioc_clear_queue(struct request_queue *q) 172 173 { 173 - LIST_HEAD(icq_list); 174 - 175 174 spin_lock_irq(&q->queue_lock); 176 - list_splice_init(&q->icq_list, &icq_list); 177 - spin_unlock_irq(&q->queue_lock); 178 - 179 - rcu_read_lock(); 180 - while (!list_empty(&icq_list)) { 175 + while (!list_empty(&q->icq_list)) { 181 176 struct io_cq *icq = 182 - list_entry(icq_list.next, struct io_cq, q_node); 177 + list_first_entry(&q->icq_list, struct io_cq, q_node); 183 178 179 + /* 180 + * Other context won't hold ioc lock to wait for queue_lock, see 181 + * details in ioc_release_fn(). 182 + */ 184 183 spin_lock_irq(&icq->ioc->lock); 185 - if (!(icq->flags & ICQ_DESTROYED)) 186 - ioc_destroy_icq(icq); 184 + ioc_destroy_icq(icq); 187 185 spin_unlock_irq(&icq->ioc->lock); 188 186 } 189 - rcu_read_unlock(); 187 + spin_unlock_irq(&q->queue_lock); 190 188 } 191 189 #else /* CONFIG_BLK_ICQ */ 192 190 static inline void ioc_exit_icqs(struct io_context *ioc)