Re: [PATCH -next v2 8/9] block: fix null-pointer dereference in ioc_pd_init

Tejun Heo
2022-11-30T20:50:34Z

On Wed, Nov 30, 2022 at 09:21:55PM +0800, Li Nan wrote:
> Remove block device when iocost is initializing may cause
> null-pointer dereference:
>
> CPU1 CPU2
> ioc_qos_write
> blkcg_conf_open_bdev
> blkdev_get_no_open
> kobject_get_unless_zero
> blk_iocost_init
> rq_qos_add
> del_gendisk
> rq_qos_exit
> q->rq_qos = rqos->next
> //iocost is removed from q->roqs
> blkcg_activate_policy
> pd_init_fn
> ioc_pd_init
> ioc = q_to_ioc(blkg->q)
> //cant find iocost and return null
>
> Fix problem by moving rq_qos_exit() to disk_release(). ioc_qos_write() get
> bd_device.kobj in blkcg_conf_open_bdev(), so disk_release will not be
> actived until iocost initialization is complited.

I think it'd be better to make del_gendisk wait for these in-flight
operations because this might fix the above particular issue but now all the
policies are exposed to request_queue in a state it never expected before.

del_gendisk() is quiescing the queue around rq_qos_exit(), so maybe we can
piggyback on that and update blkcg_conf_open_bdev() to provide such
exclusion?

Thanks.

--
tejun