Hi, 在 2022/12/01 4:50, Tejun Heo 写道:
On Wed, Nov 30, 2022 at 09:21:55PM +0800, Li Nan wrote:Remove block device when iocost is initializing may cause null-pointer dereference: CPU1 CPU2 ioc_qos_write blkcg_conf_open_bdev blkdev_get_no_open kobject_get_unless_zero blk_iocost_init rq_qos_add del_gendisk rq_qos_exit q->rq_qos = rqos->next //iocost is removed from q->roqs blkcg_activate_policy pd_init_fn ioc_pd_init ioc = q_to_ioc(blkg->q) //cant find iocost and return null Fix problem by moving rq_qos_exit() to disk_release(). ioc_qos_write() get bd_device.kobj in blkcg_conf_open_bdev(), so disk_release will not be actived until iocost initialization is complited.I think it'd be better to make del_gendisk wait for these in-flight operations because this might fix the above particular issue but now all the policies are exposed to request_queue in a state it never expected before. del_gendisk() is quiescing the queue around rq_qos_exit(), so maybe we can piggyback on that and update blkcg_conf_open_bdev() to provide such exclusion?
Let del_gendisk waiting for that sounds good, but I'm litter confused how to do that. Following are what I think about: 1) By mentioning that "del_gendisk() is quiescing the queue", do you suggest to add rcu_read_lock()? This seems wrong because blk_iocost_init requires memory allocation. 2) Hold gendisk open mutex 3) Use q_usage_counter, and in the meantime, rq_qos_add() and blkcg_activate_policy() will need refactoring to factor out freeze queue. 4) Define a new metux Thanks, Kuai
Thanks.
