From: Yu Kuai <yukuai1@huaweicloud.com>
To: axboe@kernel.dk, bvanassche@acm.org, kch@nvidia.com,
damien.lemoal@opensource.wdc.com, hare@suse.de,
vincent.fu@samsung.com, akinobu.mita@gmail.com
Cc: linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
yukuai3@huawei.com, yukuai1@huaweicloud.com, yi.zhang@huawei.com,
yangerkun@huawei.com
Subject: [PATCH -next] null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
Date: Sat, 10 Jun 2023 11:01:43 +0800 [thread overview]
Message-ID: <20230610030143.2604480-1-yukuai1@huaweicloud.com> (raw)
From: Yu Kuai <yukuai3@huawei.com>
Writing 'power' and 'submit_queues' concurrently will trigger kernel
panic:
Test script:
modprobe null_blk nr_devices=0
mkdir -p /sys/kernel/config/nullb/nullb0
while true; do echo 1 > submit_queues; echo 4 > submit_queues; done &
while true; do echo 1 > power; echo 0 > power; done
Test result:
BUG: kernel NULL pointer dereference, address: 0000000000000148
Oops: 0000 [#1] PREEMPT SMP
RIP: 0010:__lock_acquire+0x41d/0x28f0
Call Trace:
<TASK>
lock_acquire+0x121/0x450
down_write+0x5f/0x1d0
simple_recursive_removal+0x12f/0x5c0
blk_mq_debugfs_unregister_hctxs+0x7c/0x100
blk_mq_update_nr_hw_queues+0x4a3/0x720
nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
nullb_device_submit_queues_store+0x79/0xf0 [null_blk]
configfs_write_iter+0x119/0x1e0
vfs_write+0x326/0x730
ksys_write+0x74/0x150
This is because del_gendisk() can concurrent with
blk_mq_update_nr_hw_queues():
nullb_device_power_store nullb_apply_submit_queues
null_del_dev
del_gendisk
nullb_update_nr_hw_queues
if (!dev->nullb)
// still set while gendisk is deleted
return 0
blk_mq_update_nr_hw_queues
dev->nullb = NULL
Fix this problem by synchronize nullb_device_power_store() and
nullb_update_nr_hw_queues() with a mutex.
Fixes: 45919fbfe1c4 ("null_blk: Enable modifying 'submit_queues' after an instance has been configured")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
---
drivers/block/null_blk/main.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index b3fedafe301e..21c668998d95 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -1810,6 +1810,7 @@ static void null_del_dev(struct nullb *nullb)
return;
dev = nullb->dev;
+ dev->nullb = NULL;
ida_simple_remove(&nullb_indexes, nullb->index);
@@ -1831,7 +1832,6 @@ static void null_del_dev(struct nullb *nullb)
if (null_cache_active(nullb))
null_free_device_storage(nullb->dev, true);
kfree(nullb);
- dev->nullb = NULL;
}
static void null_config_discard(struct nullb *nullb)
@@ -2087,7 +2087,6 @@ static int null_add_dev(struct nullb_device *dev)
goto out;
}
nullb->dev = dev;
- dev->nullb = nullb;
spin_lock_init(&nullb->lock);
@@ -2179,6 +2178,7 @@ static int null_add_dev(struct nullb_device *dev)
if (rv)
goto out_ida_free;
+ dev->nullb = nullb;
mutex_lock(&lock);
list_add_tail(&nullb->list, &nullb_list);
mutex_unlock(&lock);
@@ -2200,7 +2200,6 @@ static int null_add_dev(struct nullb_device *dev)
cleanup_queues(nullb);
out_free_nullb:
kfree(nullb);
- dev->nullb = NULL;
out:
return rv;
}
--
2.39.2
reply other threads:[~2023-06-10 3:06 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230610030143.2604480-1-yukuai1@huaweicloud.com \
--to=yukuai1@huaweicloud.com \
--cc=akinobu.mita@gmail.com \
--cc=axboe@kernel.dk \
--cc=bvanassche@acm.org \
--cc=damien.lemoal@opensource.wdc.com \
--cc=hare@suse.de \
--cc=kch@nvidia.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=vincent.fu@samsung.com \
--cc=yangerkun@huawei.com \
--cc=yi.zhang@huawei.com \
--cc=yukuai3@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.