From: Zhong Jinghua zhongjinghua@huawei.com
hulk inclusion category: bugfix bugzilla: 187268, https://gitee.com/openeuler/kernel/issues/I5N162
----------------------------------------
This reverts commit 51e35e67694e347cf5cff3aa6ac20daa9b0b8458.
There is a new fix for this problem in the mainline patch, so the patch should return to the mainline solution.
mainline patch: d36a9ea5e776 ("block: fix use-after-free of q->q_usage_counter")
Fixes: 51e35e67694e("block: fix null-deref in percpu_ref_put") Signed-off-by: Zhong Jinghua zhongjinghua@huawei.com Reviewed-by: Hou Tao houtao1@huawei.com Signed-off-by: Jialin Zhang zhangjialin11@huawei.com --- block/blk-core.c | 4 +--- block/blk-mq.c | 7 ------- include/linux/blk-mq.h | 1 - include/linux/blkdev.h | 2 -- 4 files changed, 1 insertion(+), 13 deletions(-)
diff --git a/block/blk-core.c b/block/blk-core.c index f0e28624ef9c..2746db5f54d7 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -400,8 +400,7 @@ void blk_cleanup_queue(struct request_queue *q) * prevent that blk_mq_run_hw_queues() accesses the hardware queues * after draining finished. */ - blk_freeze_queue_start(q); - blk_mq_freeze_queue_wait_sync(q); + blk_freeze_queue(q);
rq_qos_exit(q);
@@ -518,7 +517,6 @@ static void blk_queue_usage_counter_release(struct percpu_ref *ref) struct request_queue *q = container_of(ref, struct request_queue, q_usage_counter);
- blk_queue_flag_set(QUEUE_FLAG_USAGE_COUNT_SYNC, q); wake_up_all(&q->mq_freeze_wq); }
diff --git a/block/blk-mq.c b/block/blk-mq.c index 663c9f5d6556..1eab99166fd5 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -195,7 +195,6 @@ void blk_freeze_queue_start(struct request_queue *q) { mutex_lock(&q->mq_freeze_lock); if (++q->mq_freeze_depth == 1) { - blk_queue_flag_clear(QUEUE_FLAG_USAGE_COUNT_SYNC, q); percpu_ref_kill(&q->q_usage_counter); mutex_unlock(&q->mq_freeze_lock); if (queue_is_mq(q)) @@ -206,12 +205,6 @@ void blk_freeze_queue_start(struct request_queue *q) } EXPORT_SYMBOL_GPL(blk_freeze_queue_start);
-void blk_mq_freeze_queue_wait_sync(struct request_queue *q) -{ - wait_event(q->mq_freeze_wq, percpu_ref_is_zero(&q->q_usage_counter) && - test_bit(QUEUE_FLAG_USAGE_COUNT_SYNC, &q->queue_flags)); -} - void blk_mq_freeze_queue_wait(struct request_queue *q) { wait_event(q->mq_freeze_wq, percpu_ref_is_zero(&q->q_usage_counter)); diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h index f3d78b939e01..2eca0b76b3e9 100644 --- a/include/linux/blk-mq.h +++ b/include/linux/blk-mq.h @@ -566,7 +566,6 @@ void blk_mq_freeze_queue(struct request_queue *q); void blk_mq_unfreeze_queue(struct request_queue *q); void blk_freeze_queue_start(struct request_queue *q); void blk_mq_freeze_queue_wait(struct request_queue *q); -void blk_mq_freeze_queue_wait_sync(struct request_queue *q); int blk_mq_freeze_queue_wait_timeout(struct request_queue *q, unsigned long timeout);
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index b04613bc3ed5..9ede0a81e466 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -643,8 +643,6 @@ struct request_queue { #define QUEUE_FLAG_NOWAIT 29 /* device supports NOWAIT */ /*at least one blk-mq hctx can't get driver tag */ #define QUEUE_FLAG_HCTX_WAIT 30 -/* sync for q_usage_counter */ -#define QUEUE_FLAG_USAGE_COUNT_SYNC 31
#define QUEUE_FLAG_MQ_DEFAULT ((1 << QUEUE_FLAG_IO_STAT) | \ (1 << QUEUE_FLAG_SAME_COMP) | \