diff options
| author | Ming Lei <ming.lei@redhat.com> | 2024-12-18 18:16:15 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-12-27 14:02:12 +0100 |
| commit | b5792c162dcf6197bf3d2de2be6c8169435b73d0 (patch) | |
| tree | 817d29229c6eb86473ff0aaae34ad9e6177c8872 /block | |
| parent | 0f289ba4e5ae2ff81c8954ab2bd371082cb8eddc (diff) | |
| download | linux-b5792c162dcf6197bf3d2de2be6c8169435b73d0.tar.gz linux-b5792c162dcf6197bf3d2de2be6c8169435b73d0.tar.bz2 linux-b5792c162dcf6197bf3d2de2be6c8169435b73d0.zip | |
block: avoid to reuse `hctx` not removed from cpuhp callback list
[ Upstream commit 85672ca9ceeaa1dcf2777a7048af5f4aee3fd02b ]
If the 'hctx' isn't removed from cpuhp callback list, we can't reuse it,
otherwise use-after-free may be triggered.
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202412172217.b906db7c-lkp@intel.com
Tested-by: kernel test robot <oliver.sang@intel.com>
Fixes: 22465bbac53c ("blk-mq: move cpuhp callback registering out of q->sysfs_lock")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20241218101617.3275704-3-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'block')
| -rw-r--r-- | block/blk-mq.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/block/blk-mq.c b/block/blk-mq.c index 1030875a3e95..d5995021815d 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -4421,6 +4421,15 @@ struct gendisk *blk_mq_alloc_disk_for_queue(struct request_queue *q, } EXPORT_SYMBOL(blk_mq_alloc_disk_for_queue); +/* + * Only hctx removed from cpuhp list can be reused + */ +static bool blk_mq_hctx_is_reusable(struct blk_mq_hw_ctx *hctx) +{ + return hlist_unhashed(&hctx->cpuhp_online) && + hlist_unhashed(&hctx->cpuhp_dead); +} + static struct blk_mq_hw_ctx *blk_mq_alloc_and_init_hctx( struct blk_mq_tag_set *set, struct request_queue *q, int hctx_idx, int node) @@ -4430,7 +4439,7 @@ static struct blk_mq_hw_ctx *blk_mq_alloc_and_init_hctx( /* reuse dead hctx first */ spin_lock(&q->unused_hctx_lock); list_for_each_entry(tmp, &q->unused_hctx_list, hctx_list) { - if (tmp->numa_node == node) { + if (tmp->numa_node == node && blk_mq_hctx_is_reusable(tmp)) { hctx = tmp; break; } |