diff options
| author | Ming Lei <ming.lei@redhat.com> | 2025-05-05 22:17:57 +0800 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2025-05-06 07:43:43 -0600 |
| commit | 5c3d858cdc57196e6d438e5ad47a732216e81a9c (patch) | |
| tree | 64de3b466f9096140759c1ff8f43b0fae422d595 /block/elevator.c | |
| parent | e25ee50dfab9fce77d2e0d89d2413b6c68015f97 (diff) | |
| download | linux-5c3d858cdc57196e6d438e5ad47a732216e81a9c.tar.gz linux-5c3d858cdc57196e6d438e5ad47a732216e81a9c.tar.bz2 linux-5c3d858cdc57196e6d438e5ad47a732216e81a9c.zip | |
block: fail to show/store elevator sysfs attribute if elevator is dying
Prepare for moving elv_register[unregister]_queue out of elevator_lock
& queue freezing, so we may have to call elv_unregister_queue() after
elevator ->exit() is called, then there is small window for user to
call into ->show()/store(), and user-after-free can be caused.
Fail to show/store elevator sysfs attribute if elevator is dying by
adding one new flag of ELEVATOR_FLAG_DYNG, which is protected by
elevator ->sysfs_lock.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Link: https://lore.kernel.org/r/20250505141805.2751237-20-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block/elevator.c')
| -rw-r--r-- | block/elevator.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/block/elevator.c b/block/elevator.c index fa436417da3b..2edaf84900fc 100644 --- a/block/elevator.c +++ b/block/elevator.c @@ -418,14 +418,15 @@ elv_attr_show(struct kobject *kobj, struct attribute *attr, char *page) { const struct elv_fs_entry *entry = to_elv(attr); struct elevator_queue *e; - ssize_t error; + ssize_t error = -ENODEV; if (!entry->show) return -EIO; e = container_of(kobj, struct elevator_queue, kobj); mutex_lock(&e->sysfs_lock); - error = entry->show(e, page); + if (!test_bit(ELEVATOR_FLAG_DYING, &e->flags)) + error = entry->show(e, page); mutex_unlock(&e->sysfs_lock); return error; } @@ -436,14 +437,15 @@ elv_attr_store(struct kobject *kobj, struct attribute *attr, { const struct elv_fs_entry *entry = to_elv(attr); struct elevator_queue *e; - ssize_t error; + ssize_t error = -ENODEV; if (!entry->store) return -EIO; e = container_of(kobj, struct elevator_queue, kobj); mutex_lock(&e->sysfs_lock); - error = entry->store(e, page, length); + if (!test_bit(ELEVATOR_FLAG_DYING, &e->flags)) + error = entry->store(e, page, length); mutex_unlock(&e->sysfs_lock); return error; } |