This patch series fix iocost life cycle bug.
Li Nan (2): block: fix null-pointer dereference in ioc_pd_init block: fix order error in blk_release_queue
block/blk-core.c | 2 -- block/blk-sysfs.c | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-)
hulk inclusion category: bugfix bugzilla: 188044, https://gitee.com/openeuler/kernel/issues/I64SY5 CVE: NA
--------------------------------
Remove block device when iocost is initializing may cause null-pointer dereference:
CPU1 CPU2 ioc_qos_write blkcg_conf_open_bdev blkdev_get_no_open kobject_get_unless_zero blk_iocost_init rq_qos_add blk_cleanup_queue rq_qos_exit q->rq_qos = rqos->next //iocost is removed from q->roqs blkcg_activate_policy pd_init_fn ioc_pd_init ioc = q_to_ioc(blkg->q) //can't find iocost and return null
Fix problem by moving rq_qos_exit() to blk_release_queue(). ioc_qos_write() get bd_device.kobj in blkcg_conf_open_bdev(), so blk_release_queue() will not be activated until iocost initialization is complited.
Fixes: 7caa47151ab2 ("blkcg: implement blk-iocost")
Conflict: block/blk-core.c commit 4134b63509f4 ("Revert "block: fix null-deref in percpu_ref_put"") changed context, which does not affect this patch.
Signed-off-by: Li Nan linan122@huawei.com --- block/blk-core.c | 2 -- block/blk-sysfs.c | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/block/blk-core.c b/block/blk-core.c index 06fb25bd24df..5897e7bbbee3 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -402,8 +402,6 @@ void blk_cleanup_queue(struct request_queue *q) */ blk_freeze_queue(q);
- rq_qos_exit(q); - blk_queue_flag_set(QUEUE_FLAG_DEAD, q);
/* for synchronous bio-based driver finish in-flight integrity i/o */ diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index 169e63ee05cb..8012a7e51788 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -792,6 +792,8 @@ static void blk_release_queue(struct kobject *kobj)
blk_free_queue_stats(q->stats);
+ rq_qos_exit(q); + blk_exit_queue(q);
blk_queue_free_zone_bitmaps(q);
hulk inclusion category: bugfix, https://gitee.com/openeuler/kernel/issues/I64SY5 bugzilla: 188093 CVE: NA
--------------------------------
blk_stat_free_callback() will check stats->callbacks, and wbt's callback is freed in wbt_exit(), which is called by rq_qos_exit(). So move it in front of blk_stat_free_callback().
Fixes: 015466fc61f4 ("block: fix null-pointer dereference in ioc_pd_init") Signed-off-by: Li Nan linan122@huawei.com --- block/blk-sysfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index 8012a7e51788..92dc765ef124 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -786,14 +786,14 @@ static void blk_release_queue(struct kobject *kobj)
might_sleep();
+ rq_qos_exit(q); + if (test_bit(QUEUE_FLAG_POLL_STATS, &q->queue_flags)) blk_stat_remove_callback(q, q->poll_cb); blk_stat_free_callback(q->poll_cb);
blk_free_queue_stats(q->stats);
- rq_qos_exit(q); - blk_exit_queue(q);
blk_queue_free_zone_bitmaps(q);
-
Li Nan