From: Christoph Hellwig <hch@lst.de>
To: Tong Zhang <ztong0001@gmail.com>
Cc: Sagi Grimberg <sagi@grimberg.me>,
linux-kernel@vger.kernel.org, linux-nvme@lists.infradead.org,
Jens Axboe <axboe@fb.com>, Keith Busch <kbusch@kernel.org>,
Christoph Hellwig <hch@lst.de>
Subject: Re: [PATCH] nvme: fix use-after-free during booting
Date: Wed, 23 Sep 2020 07:57:25 +0200 [thread overview]
Message-ID: <20200923055725.GA15442@lst.de> (raw)
In-Reply-To: <61E8905E-E3FE-46EB-8283-9B35B4F069E1@gmail.com>
I suspect the patch below might be better. Can you send me a full dmesg
with this one applied? Preferably on top of Jens' for-next branch?
diff --git a/block/genhd.c b/block/genhd.c
index 9d060e79eb31d8..ef2784c69d59ee 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -832,7 +832,9 @@ static void __device_add_disk(struct device *parent, struct gendisk *disk,
* Take an extra ref on queue which will be put on disk_release()
* so that it sticks around as long as @disk is there.
*/
- WARN_ON_ONCE(!blk_get_queue(disk->queue));
+ WARN_ON_ONCE(blk_queue_dying(disk->queue));
+ __blk_get_queue(disk->queue);
+ disk->flags |= GENHD_FL_QUEUE_REF;
disk_add_events(disk);
blk_integrity_add(disk);
@@ -1564,7 +1566,7 @@ static void disk_release(struct device *dev)
kfree(disk->random);
disk_replace_part_tbl(disk, NULL);
hd_free_part(&disk->part0);
- if (disk->queue)
+ if (disk->flags & GENHD_FL_QUEUE_REF)
blk_put_queue(disk->queue);
kfree(disk);
}
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index 1c97cf84f011a7..822a619924e3b5 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -133,6 +133,7 @@ struct hd_struct {
#define GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE 0x0100
#define GENHD_FL_NO_PART_SCAN 0x0200
#define GENHD_FL_HIDDEN 0x0400
+#define GENHD_FL_QUEUE_REF 0x0800
enum {
DISK_EVENT_MEDIA_CHANGE = 1 << 0, /* media changed */
_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme
WARNING: multiple messages have this Message-ID (diff)
From: Christoph Hellwig <hch@lst.de>
To: Tong Zhang <ztong0001@gmail.com>
Cc: Christoph Hellwig <hch@lst.de>, Keith Busch <kbusch@kernel.org>,
Jens Axboe <axboe@fb.com>, Sagi Grimberg <sagi@grimberg.me>,
linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] nvme: fix use-after-free during booting
Date: Wed, 23 Sep 2020 07:57:25 +0200 [thread overview]
Message-ID: <20200923055725.GA15442@lst.de> (raw)
In-Reply-To: <61E8905E-E3FE-46EB-8283-9B35B4F069E1@gmail.com>
I suspect the patch below might be better. Can you send me a full dmesg
with this one applied? Preferably on top of Jens' for-next branch?
diff --git a/block/genhd.c b/block/genhd.c
index 9d060e79eb31d8..ef2784c69d59ee 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -832,7 +832,9 @@ static void __device_add_disk(struct device *parent, struct gendisk *disk,
* Take an extra ref on queue which will be put on disk_release()
* so that it sticks around as long as @disk is there.
*/
- WARN_ON_ONCE(!blk_get_queue(disk->queue));
+ WARN_ON_ONCE(blk_queue_dying(disk->queue));
+ __blk_get_queue(disk->queue);
+ disk->flags |= GENHD_FL_QUEUE_REF;
disk_add_events(disk);
blk_integrity_add(disk);
@@ -1564,7 +1566,7 @@ static void disk_release(struct device *dev)
kfree(disk->random);
disk_replace_part_tbl(disk, NULL);
hd_free_part(&disk->part0);
- if (disk->queue)
+ if (disk->flags & GENHD_FL_QUEUE_REF)
blk_put_queue(disk->queue);
kfree(disk);
}
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index 1c97cf84f011a7..822a619924e3b5 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -133,6 +133,7 @@ struct hd_struct {
#define GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE 0x0100
#define GENHD_FL_NO_PART_SCAN 0x0200
#define GENHD_FL_HIDDEN 0x0400
+#define GENHD_FL_QUEUE_REF 0x0800
enum {
DISK_EVENT_MEDIA_CHANGE = 1 << 0, /* media changed */
next prev parent reply other threads:[~2020-09-23 5:57 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-16 15:36 [PATCH] nvme: fix use-after-free during booting Tong Zhang
2020-09-16 15:36 ` Tong Zhang
2020-09-17 8:26 ` Christoph Hellwig
2020-09-17 8:26 ` Christoph Hellwig
2020-09-17 15:24 ` Tong Zhang
2020-09-17 15:24 ` Tong Zhang
2020-09-17 15:26 ` Christoph Hellwig
2020-09-17 15:26 ` Christoph Hellwig
2020-09-22 13:59 ` Christoph Hellwig
2020-09-22 13:59 ` Christoph Hellwig
2020-09-22 15:40 ` Tong Zhang
2020-09-22 15:40 ` Tong Zhang
[not found] ` <CAA5qM4BPKZaqH0SHS3zCO7oz=f3Ow_zB2fqtJYUrbbFBNbWsNQ@mail.gmail.com>
[not found] ` <20200922164154.GA1894@lst.de>
2020-09-22 20:34 ` Tong Zhang
2020-09-22 20:34 ` Tong Zhang
2020-09-23 5:06 ` Christoph Hellwig
2020-09-23 5:06 ` Christoph Hellwig
2020-09-23 16:40 ` Tong Zhang
2020-09-23 16:40 ` Tong Zhang
2020-09-23 5:57 ` Christoph Hellwig [this message]
2020-09-23 5:57 ` Christoph Hellwig
2020-09-23 16:32 ` Tong Zhang
2020-09-23 16:32 ` Tong Zhang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200923055725.GA15442@lst.de \
--to=hch@lst.de \
--cc=axboe@fb.com \
--cc=kbusch@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nvme@lists.infradead.org \
--cc=sagi@grimberg.me \
--cc=ztong0001@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.