From: Ming Lei <ming.lei@redhat.com> mainline inclusion from mainline-v5.19-rc3 commit 5fd7a84a09e640016fe106dd3e992f5210e23dc7 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY0UQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... ------------------ elevator can be tore down by sysfs switch interface or disk release, so hold ->sysfs_lock before referring to q->elevator, then potential use-after-free can be avoided. Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://lore.kernel.org/r/20220616014401.817001-2-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Conflicts: block/blk-mq.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing@huawei.com> --- block/blk-mq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 5a9c02d0199c..a45115237e43 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -3924,12 +3924,14 @@ static bool blk_mq_elv_switch_none(struct list_head *head, if (!qe) return false; + /* q->elevator needs protection from ->sysfs_lock */ + mutex_lock(&q->sysfs_lock); + INIT_LIST_HEAD(&qe->node); qe->q = q; qe->type = q->elevator->type; list_add(&qe->node, head); - mutex_lock(&q->sysfs_lock); /* * After elevator_switch, the previous elevator_queue will be * released by elevator_release. The reference of the io scheduler -- 2.39.2