| Message ID | 20180412191111.11882-1-bart.vanassche@wdc.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, Apr 12, 2018 at 01:11:11PM -0600, Bart Van Assche wrote: > Several block drivers call alloc_disk() followed by put_disk() if > something fails before device_add_disk() is called without calling > blk_cleanup_queue(). Make sure that also for this scenario a request > queue is dissociated from the cgroup controller. This patch avoids > that loading the parport_pc, paride and pf drivers triggers the > following kernel crash: > > BUG: KASAN: null-ptr-deref in pi_init+0x42e/0x580 [paride] > Read of size 4 at addr 0000000000000008 by task modprobe/744 > Call Trace: > dump_stack+0x9a/0xeb > kasan_report+0x139/0x350 > pi_init+0x42e/0x580 [paride] > pf_init+0x2bb/0x1000 [pf] > do_one_initcall+0x8e/0x405 > do_init_module+0xd9/0x2f2 > load_module+0x3ab4/0x4700 > SYSC_finit_module+0x176/0x1a0 > do_syscall_64+0xee/0x2b0 > entry_SYSCALL_64_after_hwframe+0x42/0xb7 > > Reported-by: Alexandru Moise <00moses.alexander00@gmail.com> > Fixes: a063057d7c73 ("block: Fix a race between request queue removal and the block cgroup controller") > Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com> > Tested-by: Alexandru Moise <00moses.alexander00@gmail.com> > Cc: Tejun Heo <tj@kernel.org> > Cc: Alexandru Moise <00moses.alexander00@gmail.com> > Cc: Joseph Qi <joseph.qi@linux.alibaba.com> > --- > > Changes compared to v1: > - Surrounded use of blkcg_root with #ifdef CONFIG_BLK_CGROUP / #endif. > - Added Alex' Tested-by. > > block/blk-sysfs.c | 31 +++++++++++++++++++++++++++++++ > 1 file changed, 31 insertions(+) > > diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c > index f8457d6f0190..46bb932721dc 100644 > --- a/block/blk-sysfs.c > +++ b/block/blk-sysfs.c > @@ -793,6 +793,37 @@ static void __blk_release_queue(struct work_struct *work) > blk_stat_remove_callback(q, q->poll_cb); > blk_stat_free_callback(q->poll_cb); > > + if (!blk_queue_dead(q)) { > + /* > + * Last reference was dropped without having called > + * blk_cleanup_queue(). > + */ > + WARN_ONCE(blk_queue_init_done(q), > + "request queue %p has been registered but blk_cleanup_queue() has not been called for that queue\n", > + q); > + bdi_put(q->backing_dev_info); > + blkcg_exit_queue(q); > + > + if (q->elevator) { > + ioc_clear_queue(q); > + elevator_exit(q, q->elevator); > + } > + } > + > +#ifdef CONFIG_BLK_CGROUP > + { > + struct blkcg_gq *blkg; > + > + rcu_read_lock(); > + blkg = blkg_lookup(&blkcg_root, q); > + rcu_read_unlock(); > + > + WARN(blkg, > + "request queue %p is being released but it has not yet been removed from the blkcg controller\n", > + q); > + } > +#endif > + > blk_free_queue_stats(q->stats); > > blk_exit_rl(q, &q->root_rl); I'm not qualified enough to review it but build and boot are good. Tested-by: Alexandru Moise <00moses.alexander00@gmail.com> Thanks, ../Alex > -- > 2.16.2 >
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index f8457d6f0190..46bb932721dc 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -793,6 +793,37 @@ static void __blk_release_queue(struct work_struct *work) blk_stat_remove_callback(q, q->poll_cb); blk_stat_free_callback(q->poll_cb); + if (!blk_queue_dead(q)) { + /* + * Last reference was dropped without having called + * blk_cleanup_queue(). + */ + WARN_ONCE(blk_queue_init_done(q), + "request queue %p has been registered but blk_cleanup_queue() has not been called for that queue\n", + q); + bdi_put(q->backing_dev_info); + blkcg_exit_queue(q); + + if (q->elevator) { + ioc_clear_queue(q); + elevator_exit(q, q->elevator); + } + } + +#ifdef CONFIG_BLK_CGROUP + { + struct blkcg_gq *blkg; + + rcu_read_lock(); + blkg = blkg_lookup(&blkcg_root, q); + rcu_read_unlock(); + + WARN(blkg, + "request queue %p is being released but it has not yet been removed from the blkcg controller\n", + q); + } +#endif + blk_free_queue_stats(q->stats); blk_exit_rl(q, &q->root_rl);
Several block drivers call alloc_disk() followed by put_disk() if something fails before device_add_disk() is called without calling blk_cleanup_queue(). Make sure that also for this scenario a request queue is dissociated from the cgroup controller. This patch avoids that loading the parport_pc, paride and pf drivers triggers the following kernel crash: BUG: KASAN: null-ptr-deref in pi_init+0x42e/0x580 [paride] Read of size 4 at addr 0000000000000008 by task modprobe/744 Call Trace: dump_stack+0x9a/0xeb kasan_report+0x139/0x350 pi_init+0x42e/0x580 [paride] pf_init+0x2bb/0x1000 [pf] do_one_initcall+0x8e/0x405 do_init_module+0xd9/0x2f2 load_module+0x3ab4/0x4700 SYSC_finit_module+0x176/0x1a0 do_syscall_64+0xee/0x2b0 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Reported-by: Alexandru Moise <00moses.alexander00@gmail.com> Fixes: a063057d7c73 ("block: Fix a race between request queue removal and the block cgroup controller") Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com> Tested-by: Alexandru Moise <00moses.alexander00@gmail.com> Cc: Tejun Heo <tj@kernel.org> Cc: Alexandru Moise <00moses.alexander00@gmail.com> Cc: Joseph Qi <joseph.qi@linux.alibaba.com> --- Changes compared to v1: - Surrounded use of blkcg_root with #ifdef CONFIG_BLK_CGROUP / #endif. - Added Alex' Tested-by. block/blk-sysfs.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+)