[PATCH v2] block: Ensure that a request queue is dissociated from the cgroup controller

[PATCH v2] block: Ensure that a request queue is dissociated from the cgroup controller

[Bart Van Assche]

Several block drivers call alloc_disk() followed by put_disk() if
something fails before device_add_disk() is called without calling
blk_cleanup_queue(). Make sure that also for this scenario a request
queue is dissociated from the cgroup controller. This patch avoids
that loading the parport_pc, paride and pf drivers triggers the
following kernel crash:

BUG: KASAN: null-ptr-deref in pi_init+0x42e/0x580 [paride]
Read of size 4 at addr 0000000000000008 by task modprobe/744
Call Trace:
dump_stack+0x9a/0xeb
kasan_report+0x139/0x350
pi_init+0x42e/0x580 [paride]
pf_init+0x2bb/0x1000 [pf]
do_one_initcall+0x8e/0x405
do_init_module+0xd9/0x2f2
load_module+0x3ab4/0x4700
SYSC_finit_module+0x176/0x1a0
do_syscall_64+0xee/0x2b0
entry_SYSCALL_64_after_hwframe+0x42/0xb7

Reported-by: Alexandru Moise <00moses.alexander00@gmail.com>
Fixes: a063057d7c73 ("block: Fix a race between request queue removal and the block cgroup controller")
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Tested-by: Alexandru Moise <00moses.alexander00@gmail.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Alexandru Moise <00moses.alexander00@gmail.com>
Cc: Joseph Qi <joseph.qi@linux.alibaba.com>
---

Changes compared to v1:
- Surrounded use of blkcg_root with #ifdef CONFIG_BLK_CGROUP / #endif.
- Added Alex' Tested-by.

 block/blk-sysfs.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index f8457d6f0190..46bb932721dc 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -793,6 +793,37 @@ static void __blk_release_queue(struct work_struct *work)
 		blk_stat_remove_callback(q, q->poll_cb);
 	blk_stat_free_callback(q->poll_cb);
 
+	if (!blk_queue_dead(q)) {
+		/*
+		 * Last reference was dropped without having called
+		 * blk_cleanup_queue().
+		 */
+		WARN_ONCE(blk_queue_init_done(q),
+			  "request queue %p has been registered but blk_cleanup_queue() has not been called for that queue\n",
+			  q);
+		bdi_put(q->backing_dev_info);
+		blkcg_exit_queue(q);
+
+		if (q->elevator) {
+			ioc_clear_queue(q);
+			elevator_exit(q, q->elevator);
+		}
+	}
+
+#ifdef CONFIG_BLK_CGROUP
+	{
+		struct blkcg_gq *blkg;
+
+		rcu_read_lock();
+		blkg = blkg_lookup(&blkcg_root, q);
+		rcu_read_unlock();
+
+		WARN(blkg,
+		     "request queue %p is being released but it has not yet been removed from the blkcg controller\n",
+		     q);
+	}
+#endif
+
 	blk_free_queue_stats(q->stats);
 
 	blk_exit_rl(q, &q->root_rl);
-- 
2.16.2

Re: [PATCH v2] block: Ensure that a request queue is dissociated from the cgroup controller

[Alexandru Moise]

On Thu, Apr 12, 2018 at 01:11:11PM -0600, Bart Van Assche wrote:
> Several block drivers call alloc_disk() followed by put_disk() if
> something fails before device_add_disk() is called without calling
> blk_cleanup_queue(). Make sure that also for this scenario a request
> queue is dissociated from the cgroup controller. This patch avoids
> that loading the parport_pc, paride and pf drivers triggers the
> following kernel crash:
> 
> BUG: KASAN: null-ptr-deref in pi_init+0x42e/0x580 [paride]
> Read of size 4 at addr 0000000000000008 by task modprobe/744
> Call Trace:
> dump_stack+0x9a/0xeb
> kasan_report+0x139/0x350
> pi_init+0x42e/0x580 [paride]
> pf_init+0x2bb/0x1000 [pf]
> do_one_initcall+0x8e/0x405
> do_init_module+0xd9/0x2f2
> load_module+0x3ab4/0x4700
> SYSC_finit_module+0x176/0x1a0
> do_syscall_64+0xee/0x2b0
> entry_SYSCALL_64_after_hwframe+0x42/0xb7
> 
> Reported-by: Alexandru Moise <00moses.alexander00@gmail.com>
> Fixes: a063057d7c73 ("block: Fix a race between request queue removal and the block cgroup controller")
> Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
> Tested-by: Alexandru Moise <00moses.alexander00@gmail.com>
> Cc: Tejun Heo <tj@kernel.org>
> Cc: Alexandru Moise <00moses.alexander00@gmail.com>
> Cc: Joseph Qi <joseph.qi@linux.alibaba.com>
> ---
> 
> Changes compared to v1:
> - Surrounded use of blkcg_root with #ifdef CONFIG_BLK_CGROUP / #endif.
> - Added Alex' Tested-by.
> 
>  block/blk-sysfs.c | 31 +++++++++++++++++++++++++++++++
>  1 file changed, 31 insertions(+)
> 
> diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
> index f8457d6f0190..46bb932721dc 100644
> --- a/block/blk-sysfs.c
> +++ b/block/blk-sysfs.c
> @@ -793,6 +793,37 @@ static void __blk_release_queue(struct work_struct *work)
>  		blk_stat_remove_callback(q, q->poll_cb);
>  	blk_stat_free_callback(q->poll_cb);
>  
> +	if (!blk_queue_dead(q)) {
> +		/*
> +		 * Last reference was dropped without having called
> +		 * blk_cleanup_queue().
> +		 */
> +		WARN_ONCE(blk_queue_init_done(q),
> +			  "request queue %p has been registered but blk_cleanup_queue() has not been called for that queue\n",
> +			  q);
> +		bdi_put(q->backing_dev_info);
> +		blkcg_exit_queue(q);
> +
> +		if (q->elevator) {
> +			ioc_clear_queue(q);
> +			elevator_exit(q, q->elevator);
> +		}
> +	}
> +
> +#ifdef CONFIG_BLK_CGROUP
> +	{
> +		struct blkcg_gq *blkg;
> +
> +		rcu_read_lock();
> +		blkg = blkg_lookup(&blkcg_root, q);
> +		rcu_read_unlock();
> +
> +		WARN(blkg,
> +		     "request queue %p is being released but it has not yet been removed from the blkcg controller\n",
> +		     q);
> +	}
> +#endif
> +
>  	blk_free_queue_stats(q->stats);
>  
>  	blk_exit_rl(q, &q->root_rl);
I'm not qualified enough to review it but build and boot are good.

Tested-by: Alexandru Moise <00moses.alexander00@gmail.com>

Thanks,
../Alex
> -- 
> 2.16.2
>