Re: [PATCH] block: Ensure that a request queue is dissociated from the cgroup controller

[Alexandru Moise <00moses.alexander00@gmail.com>]

On Thu, Apr 12, 2018 at 06:20:34AM +0200, Alexandru Moise wrote:
> On Wed, Apr 11, 2018 at 07:58:52PM -0600, Bart Van Assche wrote:
> > Several block drivers call alloc_disk() followed by put_disk() if
> > something fails before device_add_disk() is called without calling
> > blk_cleanup_queue(). Make sure that also for this scenario a request
> > queue is dissociated from the cgroup controller. This patch avoids
> > that loading the parport_pc, paride and pf drivers triggers the
> > following kernel crash:
> > 
> > BUG: KASAN: null-ptr-deref in pi_init+0x42e/0x580 [paride]
> > Read of size 4 at addr 0000000000000008 by task modprobe/744
> > Call Trace:
> > dump_stack+0x9a/0xeb
> > kasan_report+0x139/0x350
> > pi_init+0x42e/0x580 [paride]
> > pf_init+0x2bb/0x1000 [pf]
> > do_one_initcall+0x8e/0x405
> > do_init_module+0xd9/0x2f2
> > load_module+0x3ab4/0x4700
> > SYSC_finit_module+0x176/0x1a0
> > do_syscall_64+0xee/0x2b0
> > entry_SYSCALL_64_after_hwframe+0x42/0xb7
> > 
> > Reported-by: Alexandru Moise <00moses.alexander00@gmail.com>
> > Fixes: a063057d7c73 ("block: Fix a race between request queue removal and the block cgroup controller")
> > Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
> > Cc: Alexandru Moise <00moses.alexander00@gmail.com>
> > Cc: Tejun Heo <tj@kernel.org>
> > ---
> >  block/blk-sysfs.c | 26 ++++++++++++++++++++++++++
> >  1 file changed, 26 insertions(+)
> > 
> > diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
> > index f8457d6f0190..2e134da78f82 100644
> > --- a/block/blk-sysfs.c
> > +++ b/block/blk-sysfs.c
> > @@ -788,11 +788,37 @@ static void blk_free_queue_rcu(struct rcu_head *rcu_head)
> >  static void __blk_release_queue(struct work_struct *work)
> >  {
> >  	struct request_queue *q = container_of(work, typeof(*q), release_work);
> > +	struct blkcg_gq *gq;
> >  
> >  	if (test_bit(QUEUE_FLAG_POLL_STATS, &q->queue_flags))
> >  		blk_stat_remove_callback(q, q->poll_cb);
> >  	blk_stat_free_callback(q->poll_cb);
> >  
> > +	if (!blk_queue_dead(q)) {
> > +		/*
> > +		 * Last reference was dropped without having called
> > +		 * blk_cleanup_queue().
> > +		 */
> > +		WARN_ONCE(blk_queue_init_done(q),
> > +			  "request queue %p has been registered but blk_cleanup_queue() has not been called for that queue\n",
> > +			  q);
> > +		bdi_put(q->backing_dev_info);
> > +		blkcg_exit_queue(q);
> > +
> > +		if (q->elevator) {
> > +			ioc_clear_queue(q);
> > +			elevator_exit(q, q->elevator);
> > +		}
> > +	}
> > +
> > +	rcu_read_lock();
> > +	gq = blkg_lookup(&blkcg_root, q);
> > +	rcu_read_unlock();
> > +
> > +	WARN(gq,
> > +	     "request queue %p is being released but it has not yet been removed from the blkcg controller\n",
> > +	     q);
> > +
> >  	blk_free_queue_stats(q->stats);
> 
> This solution is good. Thanks for fixing this!
> 
> Tested-by: Alexandru Moise <00moses.alexander00@gmail.com>
> 
> ../Alex

Oh, you also need the no-ops for !CONFIG_BLK_CGROUP, also there is no
blkcg_root then as well.

Thanks,
../Alex
> 
> >  
> >  	blk_exit_rl(q, &q->root_rl);
> > -- 
> > 2.16.2
> >