[PATCH] blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none

[PATCH] blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none

[Ming Lei]

After grabbing q->sysfs_lock, q->elevator may become NULL because of
elevator switch.

Fix the NULL dereference on q->elevator by checking it with lock.

Reported-by: Guangwu Zhang <guazhang@redhat.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
---
 block/blk-mq.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index 850bfb844ed2..9516f65a50ea 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4608,9 +4608,6 @@ static bool blk_mq_elv_switch_none(struct list_head *head,
 {
 	struct blk_mq_qe_pair *qe;
 
-	if (!q->elevator)
-		return true;
-
 	qe = kmalloc(sizeof(*qe), GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY);
 	if (!qe)
 		return false;
@@ -4618,6 +4615,12 @@ static bool blk_mq_elv_switch_none(struct list_head *head,
 	/* q->elevator needs protection from ->sysfs_lock */
 	mutex_lock(&q->sysfs_lock);
 
+	/* the check has to be done with holding sysfs_lock */
+	if (!q->elevator) {
+		kfree(qe);
+		goto unlock;
+	}
+
 	INIT_LIST_HEAD(&qe->node);
 	qe->q = q;
 	qe->type = q->elevator->type;
@@ -4625,6 +4628,7 @@ static bool blk_mq_elv_switch_none(struct list_head *head,
 	__elevator_get(qe->type);
 	list_add(&qe->node, head);
 	elevator_disable(q);
+unlock:
 	mutex_unlock(&q->sysfs_lock);
 
 	return true;
-- 
2.40.1

Re: [PATCH] blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none

[Jens Axboe]

On Fri, 16 Jun 2023 21:23:54 +0800, Ming Lei wrote:
> After grabbing q->sysfs_lock, q->elevator may become NULL because of
> elevator switch.
> 
> Fix the NULL dereference on q->elevator by checking it with lock.
> 
> 

Applied, thanks!

[1/1] blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none
      commit: 245165658e1c9f95c0fecfe02b9b1ebd30a1198a

Best regards,
-- 
Jens Axboe