MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-10-23 07:23:12 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

block: fail to show/store elevator sysfs attribute if elevator is dying

Browse Source 
Prepare for moving elv_register[unregister]_queue out of elevator_lock
& queue freezing, so we may have to call elv_unregister_queue() after
elevator ->exit() is called, then there is small window for user to
call into ->show()/store(), and user-after-free can be caused.

Fail to show/store elevator sysfs attribute if elevator is dying by
adding one new flag of ELEVATOR_FLAG_DYNG, which is protected by
elevator ->sysfs_lock.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Link: https://lore.kernel.org/r/20250505141805.2751237-20-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Ming Lei 2025-05-05 22:17:57 +08:00 committed by Jens Axboe
parent e25ee50dfa
commit 5c3d858cdc
3 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
block/blk-mq-sched.c
View File

@ -551,5 +551,6 @@ void blk_mq_exit_sched(struct request_queue *q, struct elevator_queue *e)
if (e->type->ops.exit_sched) if (e->type->ops.exit_sched)
e->type->ops.exit_sched(e); e->type->ops.exit_sched(e);
blk_mq_sched_tags_teardown(q, flags); blk_mq_sched_tags_teardown(q, flags);
set_bit(ELEVATOR_FLAG_DYING, &q->elevator->flags);
q->elevator = NULL; q->elevator = NULL;
} }

6
block/elevator.c
View File

@ -418,13 +418,14 @@ elv_attr_show(struct kobject *kobj, struct attribute *attr, char *page)
{ {
const struct elv_fs_entry *entry = to_elv(attr); const struct elv_fs_entry *entry = to_elv(attr);
struct elevator_queue *e; struct elevator_queue *e;
ssize_t error; ssize_t error = -ENODEV;
if (!entry->show) if (!entry->show)
return -EIO; return -EIO;
e = container_of(kobj, struct elevator_queue, kobj); e = container_of(kobj, struct elevator_queue, kobj);
mutex_lock(&e->sysfs_lock); mutex_lock(&e->sysfs_lock);
if (!test_bit(ELEVATOR_FLAG_DYING, &e->flags))
error = entry->show(e, page); error = entry->show(e, page);
mutex_unlock(&e->sysfs_lock); mutex_unlock(&e->sysfs_lock);
return error; return error;
@ -436,13 +437,14 @@ elv_attr_store(struct kobject *kobj, struct attribute *attr,
{ {
const struct elv_fs_entry *entry = to_elv(attr); const struct elv_fs_entry *entry = to_elv(attr);
struct elevator_queue *e; struct elevator_queue *e;
ssize_t error; ssize_t error = -ENODEV;
if (!entry->store) if (!entry->store)
return -EIO; return -EIO;
e = container_of(kobj, struct elevator_queue, kobj); e = container_of(kobj, struct elevator_queue, kobj);
mutex_lock(&e->sysfs_lock); mutex_lock(&e->sysfs_lock);
if (!test_bit(ELEVATOR_FLAG_DYING, &e->flags))
error = entry->store(e, page, length); error = entry->store(e, page, length);
mutex_unlock(&e->sysfs_lock); mutex_unlock(&e->sysfs_lock);
return error; return error;

1
block/elevator.h
View File

@ -121,6 +121,7 @@ struct elevator_queue
}; };
#define ELEVATOR_FLAG_REGISTERED 0 #define ELEVATOR_FLAG_REGISTERED 0
#define ELEVATOR_FLAG_DYING 1
/* /*
* block elevator interface * block elevator interface