This is a note to let you know that I've just added the patch titled bfq: Make sure bfqg for which we are queueing requests is online to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: bfq-make-sure-bfqg-for-which-we-are-queueing-requests-is-online.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Mon Jun 6 08:05:28 PM CEST 2022 From: Jan Kara <jack@xxxxxxx> Date: Mon, 6 Jun 2022 19:56:40 +0200 Subject: bfq: Make sure bfqg for which we are queueing requests is online To: stable@xxxxxxxxxxxxxxx Cc: <linux-block@xxxxxxxxxxxxxxx>, Paolo Valente <paolo.valente@xxxxxxxxxx>, Jens Axboe <axboe@xxxxxxxxx>, Jan Kara <jack@xxxxxxx>, "yukuai (C)" <yukuai3@xxxxxxxxxx>, Christoph Hellwig <hch@xxxxxx> Message-ID: <20220606175655.8993-5-jack@xxxxxxx> From: Jan Kara <jack@xxxxxxx> commit 075a53b78b815301f8d3dd1ee2cd99554e34f0dd upstream. Bios queued into BFQ IO scheduler can be associated with a cgroup that was already offlined. This may then cause insertion of this bfq_group into a service tree. But this bfq_group will get freed as soon as last bio associated with it is completed leading to use after free issues for service tree users. Fix the problem by making sure we always operate on online bfq_group. If the bfq_group associated with the bio is not online, we pick the first online parent. CC: stable@xxxxxxxxxxxxxxx Fixes: e21b7a0b9887 ("block, bfq: add full hierarchical scheduling and cgroups support") Tested-by: "yukuai (C)" <yukuai3@xxxxxxxxxx> Signed-off-by: Jan Kara <jack@xxxxxxx> Reviewed-by: Christoph Hellwig <hch@xxxxxx> Link: https://lore.kernel.org/r/20220401102752.8599-9-jack@xxxxxxx Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- block/bfq-cgroup.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) --- a/block/bfq-cgroup.c +++ b/block/bfq-cgroup.c @@ -608,10 +608,19 @@ static void bfq_link_bfqg(struct bfq_dat struct bfq_group *bfq_bio_bfqg(struct bfq_data *bfqd, struct bio *bio) { struct blkcg_gq *blkg = bio->bi_blkg; + struct bfq_group *bfqg; - if (!blkg) - return bfqd->root_group; - return blkg_to_bfqg(blkg); + while (blkg) { + bfqg = blkg_to_bfqg(blkg); + if (bfqg->online) { + bio_associate_blkg_from_css(bio, &blkg->blkcg->css); + return bfqg; + } + blkg = blkg->parent; + } + bio_associate_blkg_from_css(bio, + &bfqg_to_blkg(bfqd->root_group)->blkcg->css); + return bfqd->root_group; } /** Patches currently in stable-queue which might be from jack@xxxxxxx are queue-5.10/bfq-split-shared-queues-on-move-between-cgroups.patch queue-5.10/ext4-avoid-cycles-in-directory-h-tree.patch queue-5.10/bfq-get-rid-of-__bio_blkcg-usage.patch queue-5.10/ext4-fix-bug_on-in-__es_tree_search.patch queue-5.10/bfq-track-whether-bfq_group-is-still-online.patch queue-5.10/bfq-make-sure-bfqg-for-which-we-are-queueing-requests-is-online.patch queue-5.10/bfq-drop-pointless-unlock-lock-pair.patch queue-5.10/ext4-fix-bug_on-in-ext4_writepages.patch queue-5.10/dax-fix-cache-flush-on-pmd-mapped-pages.patch queue-5.10/fsnotify-fix-wrong-lockdep-annotations.patch queue-5.10/bfq-avoid-merging-queues-with-different-parents.patch queue-5.10/inotify-show-inotify-mask-flags-in-proc-fdinfo.patch queue-5.10/ext4-fix-use-after-free-in-ext4_rename_dir_prepare.patch queue-5.10/fs-writeback-writeback_sb_inodes-recalculate-wrote-according-skipped-pages.patch queue-5.10/bfq-remove-pointless-bfq_init_rq-calls.patch queue-5.10/ext4-verify-dir-block-before-splitting-it.patch queue-5.10/block-fix-bio_clone_blkg_association-to-associate-with-proper-blkcg_gq.patch queue-5.10/bfq-update-cgroup-information-before-merging-bio.patch