Patch "block: fix q->blkg_list corruption during disk rebind" has been added to the 6.8-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    block: fix q->blkg_list corruption during disk rebind

to the 6.8-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     block-fix-q-blkg_list-corruption-during-disk-rebind.patch
and it can be found in the queue-6.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ee999fbf711a3f31aeb96c920cd9e1d5281a13e7
Author: Ming Lei <ming.lei@xxxxxxxxxx>
Date:   Sun Apr 7 20:59:10 2024 +0800

    block: fix q->blkg_list corruption during disk rebind
    
    [ Upstream commit 8b8ace080319a866f5dfe9da8e665ae51d971c54 ]
    
    Multiple gendisk instances can allocated/added for single request queue
    in case of disk rebind. blkg may still stay in q->blkg_list when calling
    blkcg_init_disk() for rebind, then q->blkg_list becomes corrupted.
    
    Fix the list corruption issue by:
    
    - add blkg_init_queue() to initialize q->blkg_list & q->blkcg_mutex only
    - move calling blkg_init_queue() into blk_alloc_queue()
    
    The list corruption should be started since commit f1c006f1c685 ("blk-cgroup:
    synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()")
    which delays removing blkg from q->blkg_list into blkg_free_workfn().
    
    Fixes: f1c006f1c685 ("blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()")
    Fixes: 1059699f87eb ("block: move blkcg initialization/destroy into disk allocation/release handler")
    Cc: Yu Kuai <yukuai3@xxxxxxxxxx>
    Cc: Tejun Heo <tj@xxxxxxxxxx>
    Signed-off-by: Ming Lei <ming.lei@xxxxxxxxxx>
    Reviewed-by: Yu Kuai <yukuai3@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240407125910.4053377-1-ming.lei@xxxxxxxxxx
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index ff93c385ba5af..4529122e0cbdb 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -1409,6 +1409,12 @@ static int blkcg_css_online(struct cgroup_subsys_state *css)
 	return 0;
 }
 
+void blkg_init_queue(struct request_queue *q)
+{
+	INIT_LIST_HEAD(&q->blkg_list);
+	mutex_init(&q->blkcg_mutex);
+}
+
 int blkcg_init_disk(struct gendisk *disk)
 {
 	struct request_queue *q = disk->queue;
@@ -1416,9 +1422,6 @@ int blkcg_init_disk(struct gendisk *disk)
 	bool preloaded;
 	int ret;
 
-	INIT_LIST_HEAD(&q->blkg_list);
-	mutex_init(&q->blkcg_mutex);
-
 	new_blkg = blkg_alloc(&blkcg_root, disk, GFP_KERNEL);
 	if (!new_blkg)
 		return -ENOMEM;
diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
index b927a4a0ad030..5b0bdc268ade9 100644
--- a/block/blk-cgroup.h
+++ b/block/blk-cgroup.h
@@ -188,6 +188,7 @@ struct blkcg_policy {
 extern struct blkcg blkcg_root;
 extern bool blkcg_debug_stats;
 
+void blkg_init_queue(struct request_queue *q);
 int blkcg_init_disk(struct gendisk *disk);
 void blkcg_exit_disk(struct gendisk *disk);
 
@@ -481,6 +482,7 @@ struct blkcg {
 };
 
 static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg, void *key) { return NULL; }
+static inline void blkg_init_queue(struct request_queue *q) { }
 static inline int blkcg_init_disk(struct gendisk *disk) { return 0; }
 static inline void blkcg_exit_disk(struct gendisk *disk) { }
 static inline int blkcg_policy_register(struct blkcg_policy *pol) { return 0; }
diff --git a/block/blk-core.c b/block/blk-core.c
index de771093b5268..99d684085719d 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -431,6 +431,8 @@ struct request_queue *blk_alloc_queue(int node_id)
 	init_waitqueue_head(&q->mq_freeze_wq);
 	mutex_init(&q->mq_freeze_lock);
 
+	blkg_init_queue(q);
+
 	/*
 	 * Init percpu_ref in atomic mode so that it's faster to shutdown.
 	 * See blk_register_queue() for details.




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux