diff options
| author | Ming Lei <ming.lei@redhat.com> | 2022-03-18 14:01:43 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2022-03-18 16:57:56 +0100 |
| commit | 0a9a25ca78437b39e691bcc3dc8240455b803d8d (patch) | |
| tree | f5e4003404e754f63212e1ed349f7812e5af709c /block | |
| parent | block: avoid use-after-free on throttle data (diff) | |
| download | linux-0a9a25ca78437b39e691bcc3dc8240455b803d8d.tar.xz linux-0a9a25ca78437b39e691bcc3dc8240455b803d8d.zip | |
block: let blkcg_gq grab request queue's refcnt
In the whole lifetime of blkcg_gq instance, ->q will be referred, such
as, ->pd_free_fn() is called in blkg_free, and throtl_pd_free() still
may touch the request queue via &tg->service_queue.pending_timer which
is handled by throtl_pending_timer_fn(), so it is reasonable to grab
request queue's refcnt by blkcg_gq instance.
Previously blkcg_exit_queue() is called from blk_release_queue, and it
is hard to avoid the use-after-free. But recently commit 1059699f87eb ("block:
move blkcg initialization/destroy into disk allocation/release handler")
is merged to for-5.18/block, it becomes simple to fix the issue by simply
grabbing request queue's refcnt.
Reported-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20220318130144.1066064-3-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block')
| -rw-r--r-- | block/blk-cgroup.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index fa063c6c0338..d53b0d69dd73 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -82,6 +82,8 @@ static void blkg_free(struct blkcg_gq *blkg) if (blkg->pd[i]) blkcg_policy[i]->pd_free_fn(blkg->pd[i]); + if (blkg->q) + blk_put_queue(blkg->q); free_percpu(blkg->iostat_cpu); percpu_ref_exit(&blkg->refcnt); kfree(blkg); @@ -167,6 +169,9 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct request_queue *q, if (!blkg->iostat_cpu) goto err_free; + if (!blk_get_queue(q)) + goto err_free; + blkg->q = q; INIT_LIST_HEAD(&blkg->q_node); spin_lock_init(&blkg->async_bio_lock); |