On Wed, Nov 30, 2022 at 09:21:55PM +0800, Li Nan wrote: > Remove block device when iocost is initializing may cause > null-pointer dereference: > > CPU1 CPU2 > ioc_qos_write > blkcg_conf_open_bdev > blkdev_get_no_open > kobject_get_unless_zero > blk_iocost_init > rq_qos_add > del_gendisk > rq_qos_exit > q->rq_qos = rqos->next > //iocost is removed from q->roqs > blkcg_activate_policy > pd_init_fn > ioc_pd_init > ioc = q_to_ioc(blkg->q) > //cant find iocost and return null > > Fix problem by moving rq_qos_exit() to disk_release(). ioc_qos_write() get > bd_device.kobj in blkcg_conf_open_bdev(), so disk_release will not be > actived until iocost initialization is complited. I think it'd be better to make del_gendisk wait for these in-flight operations because this might fix the above particular issue but now all the policies are exposed to request_queue in a state it never expected before. del_gendisk() is quiescing the queue around rq_qos_exit(), so maybe we can piggyback on that and update blkcg_conf_open_bdev() to provide such exclusion? Thanks. -- tejun
