Inside __blk_mq_update_nr_hw_queues(), only request queues are frozen
before updating nr_hw_queues.
However, even though blk_mq_freeze_queue() is returned, there might be
run queue activity not completed, then use-after-free may be triggered
on hctx and its fields.
Fix this issue by really quiescing queue via blk_mq_quiesce_queue() and
blk_sync_queue() for making sure no any run queue activity pending
before releasing hctx.
Cc: Dongli Zhang <dongli.zhang@xxxxxxxxxx>
Cc: James Smart <james.smart@xxxxxxxxxxxx>
Cc: Bart Van Assche <bart.vanassche@xxxxxxx>
Cc: linux-scsi@xxxxxxxxxxxxxxx,
Cc: Martin K . Petersen <martin.petersen@xxxxxxxxxx>,
Cc: Christoph Hellwig <hch@xxxxxx>,
Cc: James E . J . Bottomley <jejb@xxxxxxxxxxxxxxxxxx>,
Cc: jianchao wang <jianchao.w.wang@xxxxxxxxxx>
Reported-by: Bart Van Assche <bvanassche@xxxxxxx>
Signed-off-by: Ming Lei <ming.lei@xxxxxxxxxx>
---
block/blk-mq.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index b512ba0cb359..41c12d9008b7 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -3224,8 +3224,11 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,
if (nr_hw_queues < 1 || nr_hw_queues == set->nr_hw_queues)
return;
- list_for_each_entry(q, &set->tag_list, tag_set_list)
+ list_for_each_entry(q, &set->tag_list, tag_set_list) {
blk_mq_freeze_queue(q);
+ blk_mq_quiesce_queue(q);
+ blk_sync_queue(q);
+ }
/*
* Sync with blk_mq_queue_tag_busy_iter.
*/
@@ -3269,8 +3272,10 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,
list_for_each_entry(q, &set->tag_list, tag_set_list)
blk_mq_elv_switch_back(&head, q);
- list_for_each_entry(q, &set->tag_list, tag_set_list)
+ list_for_each_entry(q, &set->tag_list, tag_set_list) {
+ blk_mq_unquiesce_queue(q);
blk_mq_unfreeze_queue(q);
+ }
}
void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues)
--
2.9.5
