• Ming Lei's avatar
    blk-mq: free hw queue's resource in hctx's release handler · c7e2d94b
    Ming Lei authored
    Once blk_cleanup_queue() returns, tags shouldn't be used any more,
    because blk_mq_free_tag_set() may be called. Commit 45a9c9d9
    ("blk-mq: Fix a use-after-free") fixes this issue exactly.
    
    However, that commit introduces another issue. Before 45a9c9d9,
    we are allowed to run queue during cleaning up queue if the queue's
    kobj refcount is held. After that commit, queue can't be run during
    queue cleaning up, otherwise oops can be triggered easily because
    some fields of hctx are freed by blk_mq_free_queue() in blk_cleanup_queue().
    
    We have invented ways for addressing this kind of issue before, such as:
    
    	8dc765d4 ("SCSI: fix queue cleanup race before queue initialization is done")
    	c2856ae2 ("blk-mq: quiesce queue before freeing queue")
    
    But still can't cover all cases, recently James reports another such
    kind of issue:
    
    	https://marc.info/?l=linux-scsi&m=155389088124782&w=2
    
    This issue can be quite hard to address by previous way, given
    scsi_run_queue() may run requeues for other LUNs.
    
    Fixes the above issue by freeing hctx's resources in its release handler, and this
    way is safe becasue tags isn't needed for freeing such hctx resource.
    
    This approach follows typical design pattern wrt. kobject's release handler.
    
    Cc: Dongli Zhang <dongli.zhang@oracle.com>
    Cc: James Smart <james.smart@broadcom.com>
    Cc: Bart Van Assche <bart.vanassche@wdc.com>
    Cc: linux-scsi@vger.kernel.org,
    Cc: Martin K . Petersen <martin.petersen@oracle.com>,
    Cc: Christoph Hellwig <hch@lst.de>,
    Cc: James E . J . Bottomley <jejb@linux.vnet.ibm.com>,
    Reported-by: default avatarJames Smart <james.smart@broadcom.com>
    Fixes: 45a9c9d9 ("blk-mq: Fix a use-after-free")
    Cc: stable@vger.kernel.org
    Reviewed-by: default avatarHannes Reinecke <hare@suse.com>
    Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
    Tested-by: default avatarJames Smart <james.smart@broadcom.com>
    Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
    Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
    c7e2d94b
blk-core.c 48.5 KB