diff options
author | Ming Lei <ming.lei@redhat.com> | 2022-06-16 03:43:59 +0200 |
---|---|---|
committer | Jens Axboe <axboe@kernel.dk> | 2022-06-16 22:45:15 +0200 |
commit | 5fd7a84a09e640016fe106dd3e992f5210e23dc7 (patch) | |
tree | 9a9e375e7ad18f3d650f37756f701b486b3a436b /block | |
parent | block: Fix handling of offline queues in blk_mq_alloc_request_hctx() (diff) | |
download | linux-5fd7a84a09e640016fe106dd3e992f5210e23dc7.tar.xz linux-5fd7a84a09e640016fe106dd3e992f5210e23dc7.zip |
blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none
elevator can be tore down by sysfs switch interface or disk release, so
hold ->sysfs_lock before referring to q->elevator, then potential
use-after-free can be avoided.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20220616014401.817001-2-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block')
-rw-r--r-- | block/blk-mq.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/block/blk-mq.c b/block/blk-mq.c index 26a7f802d7ee..c13d03b2e17c 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -4440,12 +4440,14 @@ static bool blk_mq_elv_switch_none(struct list_head *head, if (!qe) return false; + /* q->elevator needs protection from ->sysfs_lock */ + mutex_lock(&q->sysfs_lock); + INIT_LIST_HEAD(&qe->node); qe->q = q; qe->type = q->elevator->type; list_add(&qe->node, head); - mutex_lock(&q->sysfs_lock); /* * After elevator_switch_mq, the previous elevator_queue will be * released by elevator_release. The reference of the io scheduler |