blk-mq: Fix missed srcu_barrier() calls before cleanup_srcu_struct() - #1160
Open
blktests-ci[bot] wants to merge 1 commit into
Open
blk-mq: Fix missed srcu_barrier() calls before cleanup_srcu_struct()#1160blktests-ci[bot] wants to merge 1 commit into
blktests-ci[bot] wants to merge 1 commit into
Conversation
In blk_mq_alloc_tag_set(), if blk_mq_alloc_set_map_and_rqs() fails after some hardware queues have already been allocated, its unwind path frees the partially allocated maps and tags through invoke the blk_mq_free_map_and_rqs()->blk_mq_free_tags(), which issues call_srcu() against set->tags_srcu. control then returns to blk_mq_alloc_tag_set() and falls through to the out_cleanup_tags_srcu label, which calls cleanup_srcu_struct() directly. Calling cleanup_srcu_struct() while call_srcu() callbacks are still outstanding is illegal, it triggers a WARN and tears down the srcu_struct while the pending blk_mq_free_tags_callback() still references it, leading to a use-after-free. The normal teardown path in blk_mq_free_tag_set() already guards against this by calling srcu_barrier() before cleanup_srcu_struct(), but the error path in blk_mq_alloc_tag_set() was missing the same barrier. this commit therefore also add srcu_barrier(&set->tags_srcu) call so that all outstanding SRCU callbacks complete before the srcu_struct is destroyed. Fixes: ad0d05d ("blk-mq: Defer freeing of tags page_list to SRCU callback") Signed-off-by: Zqiang <qiang.zhang@linux.dev>
Author
|
Upstream branch: bd5f485 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request for series with
subject: blk-mq: Fix missed srcu_barrier() calls before cleanup_srcu_struct()
version: 1
url: https://patchwork.kernel.org/project/linux-block/list/?series=1148997