Patch "aoe: avoid potential deadlock at set_capacity" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    aoe: avoid potential deadlock at set_capacity

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     aoe-avoid-potential-deadlock-at-set_capacity.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 6f1f0cae462a5051abbd6f13d893b1b2e0974237
Author: Maksim Kiselev <bigunclemax@xxxxxxxxx>
Date:   Wed Jan 24 10:24:36 2024 +0300

    aoe: avoid potential deadlock at set_capacity
    
    [ Upstream commit e169bd4fb2b36c4b2bee63c35c740c85daeb2e86 ]
    
    Move set_capacity() outside of the section procected by (&d->lock).
    To avoid possible interrupt unsafe locking scenario:
    
            CPU0                    CPU1
            ----                    ----
    [1] lock(&bdev->bd_size_lock);
                                    local_irq_disable();
                                [2] lock(&d->lock);
                                [3] lock(&bdev->bd_size_lock);
       <Interrupt>
    [4]  lock(&d->lock);
    
      *** DEADLOCK ***
    
    Where [1](&bdev->bd_size_lock) hold by zram_add()->set_capacity().
    [2]lock(&d->lock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc()
    is trying to acquire [3](&bdev->bd_size_lock) at set_capacity() call.
    In this situation an attempt to acquire [4]lock(&d->lock) from
    aoecmd_cfg_rsp() will lead to deadlock.
    
    So the simplest solution is breaking lock dependency
    [2](&d->lock) -> [3](&bdev->bd_size_lock) by moving set_capacity()
    outside.
    
    Signed-off-by: Maksim Kiselev <bigunclemax@xxxxxxxxx>
    Reviewed-by: Christoph Hellwig <hch@xxxxxx>
    Link: https://lore.kernel.org/r/20240124072436.3745720-2-bigunclemax@xxxxxxxxx
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/block/aoe/aoeblk.c b/drivers/block/aoe/aoeblk.c
index cf6883756155a..37eff1c974515 100644
--- a/drivers/block/aoe/aoeblk.c
+++ b/drivers/block/aoe/aoeblk.c
@@ -333,6 +333,7 @@ aoeblk_gdalloc(void *vp)
 	struct gendisk *gd;
 	mempool_t *mp;
 	struct blk_mq_tag_set *set;
+	sector_t ssize;
 	ulong flags;
 	int late = 0;
 	int err;
@@ -395,7 +396,7 @@ aoeblk_gdalloc(void *vp)
 	gd->minors = AOE_PARTITIONS;
 	gd->fops = &aoe_bdops;
 	gd->private_data = d;
-	set_capacity(gd, d->ssize);
+	ssize = d->ssize;
 	snprintf(gd->disk_name, sizeof gd->disk_name, "etherd/e%ld.%d",
 		d->aoemajor, d->aoeminor);
 
@@ -404,6 +405,8 @@ aoeblk_gdalloc(void *vp)
 
 	spin_unlock_irqrestore(&d->lock, flags);
 
+	set_capacity(gd, ssize);
+
 	err = device_add_disk(NULL, gd, aoe_attr_groups);
 	if (err)
 		goto out_disk_cleanup;