Nilay Shroff f1a494df83 block: Fix potential deadlock while freezing queue and acquiring sysfs_lock ... [ Upstream commit be26ba9642 ] For storing a value to a queue attribute, the queue_attr_store function first freezes the queue (->q_usage_counter(io)) and then acquire ->sysfs_lock. This seems not correct as the usual ordering should be to acquire ->sysfs_lock before freezing the queue. This incorrect ordering causes the following lockdep splat which we are able to reproduce always simply by accessing /sys/kernel/debug file using ls command: [ 57.597146] WARNING: possible circular locking dependency detected [ 57.597154] 6.12.0-10553-gb86545e02e8c #20 Tainted: G W [ 57.597162] ------------------------------------------------------ [ 57.597168] ls/4605 is trying to acquire lock: [ 57.597176] c00000003eb56710 (&mm->mmap_lock){++++}-{4:4}, at: __might_fault+0x58/0xc0 [ 57.597200] but task is already holding lock: [ 57.597207] c0000018e27c6810 (&sb->s_type->i_mutex_key#3){++++}-{4:4}, at: iterate_dir+0x94/0x1d4 [ 57.597226] which lock already depends on the new lock. [ 57.597233] the existing dependency chain (in reverse order) is: [ 57.597241] -> #5 (&sb->s_type->i_mutex_key#3){++++}-{4:4}: [ 57.597255] down_write+0x6c/0x18c [ 57.597264] start_creating+0xb4/0x24c [ 57.597274] debugfs_create_dir+0x2c/0x1e8 [ 57.597283] blk_register_queue+0xec/0x294 [ 57.597292] add_disk_fwnode+0x2e4/0x548 [ 57.597302] brd_alloc+0x2c8/0x338 [ 57.597309] brd_init+0x100/0x178 [ 57.597317] do_one_initcall+0x88/0x3e4 [ 57.597326] kernel_init_freeable+0x3cc/0x6e0 [ 57.597334] kernel_init+0x34/0x1cc [ 57.597342] ret_from_kernel_user_thread+0x14/0x1c [ 57.597350] -> #4 (&q->debugfs_mutex){+.+.}-{4:4}: [ 57.597362] __mutex_lock+0xfc/0x12a0 [ 57.597370] blk_register_queue+0xd4/0x294 [ 57.597379] add_disk_fwnode+0x2e4/0x548 [ 57.597388] brd_alloc+0x2c8/0x338 [ 57.597395] brd_init+0x100/0x178 [ 57.597402] do_one_initcall+0x88/0x3e4 [ 57.597410] kernel_init_freeable+0x3cc/0x6e0 [ 57.597418] kernel_init+0x34/0x1cc [ 57.597426] ret_from_kernel_user_thread+0x14/0x1c [ 57.597434] -> #3 (&q->sysfs_lock){+.+.}-{4:4}: [ 57.597446] __mutex_lock+0xfc/0x12a0 [ 57.597454] queue_attr_store+0x9c/0x110 [ 57.597462] sysfs_kf_write+0x70/0xb0 [ 57.597471] kernfs_fop_write_iter+0x1b0/0x2ac [ 57.597480] vfs_write+0x3dc/0x6e8 [ 57.597488] ksys_write+0x84/0x140 [ 57.597495] system_call_exception+0x130/0x360 [ 57.597504] system_call_common+0x160/0x2c4 [ 57.597516] -> #2 (&q->q_usage_counter(io)#21){++++}-{0:0}: [ 57.597530] __submit_bio+0x5ec/0x828 [ 57.597538] submit_bio_noacct_nocheck+0x1e4/0x4f0 [ 57.597547] iomap_readahead+0x2a0/0x448 [ 57.597556] xfs_vm_readahead+0x28/0x3c [ 57.597564] read_pages+0x88/0x41c [ 57.597571] page_cache_ra_unbounded+0x1ac/0x2d8 [ 57.597580] filemap_get_pages+0x188/0x984 [ 57.597588] filemap_read+0x13c/0x4bc [ 57.597596] xfs_file_buffered_read+0x88/0x17c [ 57.597605] xfs_file_read_iter+0xac/0x158 [ 57.597614] vfs_read+0x2d4/0x3b4 [ 57.597622] ksys_read+0x84/0x144 [ 57.597629] system_call_exception+0x130/0x360 [ 57.597637] system_call_common+0x160/0x2c4 [ 57.597647] -> #1 (mapping.invalidate_lock#2){++++}-{4:4}: [ 57.597661] down_read+0x6c/0x220 [ 57.597669] filemap_fault+0x870/0x100c [ 57.597677] xfs_filemap_fault+0xc4/0x18c [ 57.597684] __do_fault+0x64/0x164 [ 57.597693] __handle_mm_fault+0x1274/0x1dac [ 57.597702] handle_mm_fault+0x248/0x484 [ 57.597711] ___do_page_fault+0x428/0xc0c [ 57.597719] hash__do_page_fault+0x30/0x68 [ 57.597727] do_hash_fault+0x90/0x35c [ 57.597736] data_access_common_virt+0x210/0x220 [ 57.597745] _copy_from_user+0xf8/0x19c [ 57.597754] sel_write_load+0x178/0xd54 [ 57.597762] vfs_write+0x108/0x6e8 [ 57.597769] ksys_write+0x84/0x140 [ 57.597777] system_call_exception+0x130/0x360 [ 57.597785] system_call_common+0x160/0x2c4 [ 57.597794] -> #0 (&mm->mmap_lock){++++}-{4:4}: [ 57.597806] __lock_acquire+0x17cc/0x2330 [ 57.597814] lock_acquire+0x138/0x400 [ 57.597822] __might_fault+0x7c/0xc0 [ 57.597830] filldir64+0xe8/0x390 [ 57.597839] dcache_readdir+0x80/0x2d4 [ 57.597846] iterate_dir+0xd8/0x1d4 [ 57.597855] sys_getdents64+0x88/0x2d4 [ 57.597864] system_call_exception+0x130/0x360 [ 57.597872] system_call_common+0x160/0x2c4 [ 57.597881] other info that might help us debug this: [ 57.597888] Chain exists of: &mm->mmap_lock --> &q->debugfs_mutex --> &sb->s_type->i_mutex_key#3 [ 57.597905] Possible unsafe locking scenario: [ 57.597911] CPU0 CPU1 [ 57.597917] ---- ---- [ 57.597922] rlock(&sb->s_type->i_mutex_key#3); [ 57.597932] lock(&q->debugfs_mutex); [ 57.597940] lock(&sb->s_type->i_mutex_key#3); [ 57.597950] rlock(&mm->mmap_lock); [ 57.597958] *** DEADLOCK *** [ 57.597965] 2 locks held by ls/4605: [ 57.597971] #0: c0000000137c12f8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0xcc/0x154 [ 57.597989] #1: c0000018e27c6810 (&sb->s_type->i_mutex_key#3){++++}-{4:4}, at: iterate_dir+0x94/0x1d4 Prevent the above lockdep warning by acquiring ->sysfs_lock before freezing the queue while storing a queue attribute in queue_attr_store function. Later, we also found[1] another function __blk_mq_update_nr_ hw_queues where we first freeze queue and then acquire the ->sysfs_lock. So we've also updated lock ordering in __blk_mq_update_nr_hw_queues function and ensured that in all code paths we follow the correct lock ordering i.e. acquire ->sysfs_lock before freezing the queue. [1] https://lore.kernel.org/all/CAFj5m9Ke8+EHKQBs_Nk6hqd=LGXtk4mUxZUN5==ZcCjnZSBwHw@mail.gmail.com/ Reported-by: kjain@linux.ibm.com Fixes: af28141498 ("block: freeze the queue in queue_attr_store") Tested-by: kjain@linux.ibm.com Cc: hch@lst.de Cc: axboe@kernel.dk Cc: ritesh.list@gmail.com Cc: ming.lei@redhat.com Cc: gjoyce@linux.ibm.com Signed-off-by: Nilay Shroff <nilay@linux.ibm.com> Reviewed-by: Ming Lei <ming.lei@redhat.com> Link: https://lore.kernel.org/r/20241210144222.1066229-1-nilay@linux.ibm.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-12-19 18:13:22 +01:00
..
partitions	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
badblocks.c	badblocks: avoid checking invalid range in badblocks_check()	2023-12-23 18:38:08 -07:00
bdev.c	for-6.12/block-20240925	2024-09-25 14:56:40 -07:00
bfq-cgroup.c	Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()"	2024-12-05 14:02:54 +01:00
bfq-iosched.c	block, bfq: fix bfqq uaf in bfq_limit_depth()	2024-12-05 14:03:09 +01:00
bfq-iosched.h	block, bfq: remove bfq_log_bfqg()	2024-09-10 16:32:09 -06:00
bfq-wf2q.c
bio-integrity.c	Linux 6.11	2024-09-17 08:32:53 -06:00
bio.c	block: unpin user pages belonging to a folio at once	2024-09-11 07:24:01 -06:00
blk-cgroup-fc-appid.c	block: Replace all non-returning strlcpy with strscpy	2023-06-01 09:13:31 -06:00
blk-cgroup-rwstat.c	blk-cgroup: use group allocation/free of per-cpu counters API	2024-04-03 09:10:17 -06:00
blk-cgroup-rwstat.h
blk-cgroup.c	blk-cgroup: Fix UAF in blkcg_unpin_online()	2024-12-19 18:13:00 +01:00
blk-cgroup.h	blk-cgroup: Remove unused declaration blkg_path()	2024-08-16 15:07:27 -06:00
blk-core.c	block: always verify unfreeze lock on the owner task	2024-12-05 14:03:10 +01:00
blk-crypto-fallback.c	block, fs: Restore the per-bio/request data lifetime fields	2024-02-06 14:31:05 +01:00
blk-crypto-internal.h
blk-crypto-profile.c	blk-crypto: use dynamic lock class for blk_crypto_profile::lock	2023-07-05 16:36:12 -06:00
blk-crypto-sysfs.c
blk-crypto.c
blk-flush.c	for-6.11/block-20240710	2024-07-15 14:20:22 -07:00
blk-ia-ranges.c
blk-integrity.c	block: fix blk_rq_map_integrity_sg kernel-doc	2024-10-02 07:15:33 -06:00
blk-ioc.c	blk-ioc: fix recursive spin_lock/unlock_irq() in ioc_clear_queue()	2023-06-07 07:51:00 -06:00
blk-iocost.c	blk-iocost: Avoid using clamp() on inuse in __propagate_weights()	2024-12-19 18:13:22 +01:00
blk-iolatency.c	block: add blk_time_get_ns() and blk_time_get() helpers	2024-02-05 10:07:22 -07:00
blk-ioprio.c	blk-ioprio: remove per-disk structure	2024-07-28 16:47:51 -06:00
blk-ioprio.h	blk-ioprio: remove per-disk structure	2024-07-28 16:47:51 -06:00
blk-lib.c	block: fix detection of unsupported WRITE SAME in blkdev_issue_write_zeroes	2024-08-28 08:49:25 -06:00
blk-map.c	block: fix queue limits checks in blk_rq_map_user_bvec for real	2024-10-28 12:35:05 -06:00
blk-merge.c	block: fix bio_split_rw_at to take zone_write_granularity into account	2024-12-05 14:01:14 +01:00
blk-mq-cpumap.c	blk-mq: include <linux/blk-mq.h> in block/blk-mq.h	2023-04-13 06:52:29 -06:00
blk-mq-debugfs.c	block: Catch possible entries missing from rqf_name[]	2024-07-19 09:32:49 -06:00
blk-mq-debugfs.h	block: Replace zone_wlock debugfs entry with zone_wplugs entry	2024-04-17 08:44:03 -06:00
blk-mq-pci.c	blk-mq: include <linux/blk-mq.h> in block/blk-mq.h	2023-04-13 06:52:29 -06:00
blk-mq-sched.c	blk-mq: Remove the hctx 'run' debugfs attribute	2024-01-17 14:16:34 -07:00
blk-mq-sched.h	blk-mq: make sure elevator callbacks aren't called for passthrough request	2023-05-18 19:42:54 -06:00
blk-mq-sysfs.c	block: Fix potential deadlock while freezing queue and acquiring sysfs_lock	2024-12-19 18:13:22 +01:00
blk-mq-tag.c	block: Fix lockdep warning in blk_mq_mark_tag_wait	2024-08-15 19:25:03 -06:00
blk-mq-virtio.c	blk-mq: include <linux/blk-mq.h> in block/blk-mq.h	2023-04-13 06:52:29 -06:00
blk-mq.c	block: Fix potential deadlock while freezing queue and acquiring sysfs_lock	2024-12-19 18:13:22 +01:00
blk-mq.h	block: fix ordering between checking BLK_MQ_S_STOPPED request adding	2024-12-05 14:02:55 +01:00
blk-pm.c	block: Remove blk_set_runtime_active()	2023-11-20 10:22:40 -07:00
blk-pm.h
blk-rq-qos.c	blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race	2024-10-16 07:20:14 -06:00
blk-rq-qos.h	block: skip QUEUE_FLAG_STATS and rq-qos for passthrough io	2023-12-01 18:29:18 -07:00
blk-settings.c	blk-settings: round down io_opt to physical_block_size	2024-12-05 14:02:51 +01:00
blk-stat.c	blk-throttle: remove CONFIG_BLK_DEV_THROTTLING_LOW	2024-05-09 09:44:55 -06:00
blk-stat.h	block: delete redundant function declaration	2024-05-27 13:58:06 -06:00
blk-sysfs.c	block: Fix potential deadlock while freezing queue and acquiring sysfs_lock	2024-12-19 18:13:22 +01:00
blk-throttle.c	Linux 6.11	2024-09-17 08:32:53 -06:00
blk-throttle.h	blk-throttle: remove last_low_overflow_time	2024-09-10 16:31:41 -06:00
blk-timeout.c
blk-wbt.c	blk-wbt: don't throttle swap writes in direct reclaim	2024-07-01 06:51:53 -06:00
blk-wbt.h	blk-wbt: remove the separate write cache tracking	2023-12-26 09:28:10 -07:00
blk-zoned.c	block: get wp_offset by bdev_offset_from_zone_start	2024-12-19 18:13:16 +01:00
blk.h	block: always verify unfreeze lock on the owner task	2024-12-05 14:03:10 +01:00
bounce.c	block: split integrity support out of bio.h	2024-07-03 10:21:15 -06:00
bsg-lib.c	scsi: bsg: Pass dev to blk_mq_alloc_queue()	2024-05-30 20:22:15 -04:00
bsg.c	SCSI misc on 20230629	2023-06-30 11:57:07 -07:00
disk-events.c	block: move bdev_mark_dead out of disk_check_media_change	2023-10-28 13:29:23 +02:00
early-lookup.c	wrapper for access to ->bd_partno	2024-05-02 17:48:09 -04:00
elevator.c	block: don't verify IO lock for freeze/unfreeze in elevator_init_mq()	2024-12-05 14:03:10 +01:00
elevator.h	block: Prevent deadlocks when switching elevators	2024-09-10 13:43:42 -06:00
fops.c	block: Don't allow an atomic write be truncated in blkdev_write_iter()	2024-12-05 14:03:08 +01:00
genhd.c	block: fix uaf for flush rq while iterating tags	2024-12-05 14:03:06 +01:00
holder.c	block: fix deadlock between bd_link_disk_holder and partition scan	2024-02-23 07:44:19 -07:00
ioctl.c	block: implement async io_uring discard cmd	2024-09-11 10:45:28 -06:00
ioprio.c	block: move __get_task_ioprio() into header file	2024-01-08 12:27:39 -07:00
Kconfig	block: remove the blk_integrity_profile structure	2024-06-14 10:20:06 -06:00
Kconfig.iosched
kyber-iosched.c	blk-mq: pass a flags argument to elevator_type->insert_requests	2023-04-13 06:52:30 -06:00
Makefile	block: remove the blk_integrity_profile structure	2024-06-14 10:20:06 -06:00
mq-deadline.c	block/mq-deadline: Fix the tag reservation code	2024-07-02 08:47:45 -06:00
opal_proto.h	block: sed-opal: handle empty atoms when parsing response	2024-02-16 15:52:45 -07:00
sed-opal.c	block: sed-opal: avoid possible wrong address reference in read_sed_opal_key()	2024-06-12 10:53:20 -06:00
t10-pi.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00