Patch "Revert "Revert "block, bfq: honor already-setup queue merges""" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    Revert "Revert "block, bfq: honor already-setup queue merges""

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     revert-revert-block-bfq-honor-already-setup-queue-me.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 923298850da421ba4d35a40ac62fb636362f72b1
Author: Paolo Valente <paolo.valente@xxxxxxxxxx>
Date:   Thu Nov 25 19:15:10 2021 +0100

    Revert "Revert "block, bfq: honor already-setup queue merges""
    
    [ Upstream commit 15729ff8143f8135b03988a100a19e66d7cb7ecd ]
    
    A crash [1] happened to be triggered in conjunction with commit
    2d52c58b9c9b ("block, bfq: honor already-setup queue merges"). The
    latter was then reverted by commit ebc69e897e17 ("Revert "block, bfq:
    honor already-setup queue merges""). Yet, the reverted commit was not
    the one introducing the bug. In fact, it actually triggered a UAF
    introduced by a different commit, and now fixed by commit d29bd41428cf
    ("block, bfq: reset last_bfqq_created on group change").
    
    So, there is no point in keeping commit 2d52c58b9c9b ("block, bfq:
    honor already-setup queue merges") out. This commit restores it.
    
    [1] https://bugzilla.kernel.org/show_bug.cgi?id=214503
    
    Reported-by: Holger Hoffstätte <holger@xxxxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Paolo Valente <paolo.valente@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20211125181510.15004-1-paolo.valente@xxxxxxxxxx
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 9843085cc2c3..63d2d66dece5 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -2662,6 +2662,15 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
 	 * are likely to increase the throughput.
 	 */
 	bfqq->new_bfqq = new_bfqq;
+	/*
+	 * The above assignment schedules the following redirections:
+	 * each time some I/O for bfqq arrives, the process that
+	 * generated that I/O is disassociated from bfqq and
+	 * associated with new_bfqq. Here we increases new_bfqq->ref
+	 * in advance, adding the number of processes that are
+	 * expected to be associated with new_bfqq as they happen to
+	 * issue I/O.
+	 */
 	new_bfqq->ref += process_refs;
 	return new_bfqq;
 }
@@ -2724,6 +2733,10 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
 {
 	struct bfq_queue *in_service_bfqq, *new_bfqq;
 
+	/* if a merge has already been setup, then proceed with that first */
+	if (bfqq->new_bfqq)
+		return bfqq->new_bfqq;
+
 	/*
 	 * Check delayed stable merge for rotational or non-queueing
 	 * devs. For this branch to be executed, bfqq must not be
@@ -2825,9 +2838,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
 	if (bfq_too_late_for_merging(bfqq))
 		return NULL;
 
-	if (bfqq->new_bfqq)
-		return bfqq->new_bfqq;
-
 	if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq))
 		return NULL;