| From foo@baz Sun Jun 17 12:07:33 CEST 2018 |
| From: Jiang Biao <jiang.biao2@zte.com.cn> |
| Date: Thu, 19 Apr 2018 12:06:09 +0800 |
| Subject: blkcg: init root blkcg_gq under lock |
| |
| From: Jiang Biao <jiang.biao2@zte.com.cn> |
| |
| [ Upstream commit 901932a3f9b2b80352896be946c6d577c0a9652c ] |
| |
| The initializing of q->root_blkg is currently outside of queue lock |
| and rcu, so the blkg may be destroied before the initializing, which |
| may cause dangling/null references. On the other side, the destroys |
| of blkg are protected by queue lock or rcu. Put the initializing |
| inside the queue lock and rcu to make it safer. |
| |
| Signed-off-by: Jiang Biao <jiang.biao2@zte.com.cn> |
| Signed-off-by: Wen Yang <wen.yang99@zte.com.cn> |
| CC: Tejun Heo <tj@kernel.org> |
| CC: Jens Axboe <axboe@kernel.dk> |
| Signed-off-by: Jens Axboe <axboe@kernel.dk> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| block/blk-cgroup.c | 17 +++++++++++------ |
| 1 file changed, 11 insertions(+), 6 deletions(-) |
| |
| --- a/block/blk-cgroup.c |
| +++ b/block/blk-cgroup.c |
| @@ -1142,18 +1142,16 @@ int blkcg_init_queue(struct request_queu |
| rcu_read_lock(); |
| spin_lock_irq(q->queue_lock); |
| blkg = blkg_create(&blkcg_root, q, new_blkg); |
| + if (IS_ERR(blkg)) |
| + goto err_unlock; |
| + q->root_blkg = blkg; |
| + q->root_rl.blkg = blkg; |
| spin_unlock_irq(q->queue_lock); |
| rcu_read_unlock(); |
| |
| if (preloaded) |
| radix_tree_preload_end(); |
| |
| - if (IS_ERR(blkg)) |
| - return PTR_ERR(blkg); |
| - |
| - q->root_blkg = blkg; |
| - q->root_rl.blkg = blkg; |
| - |
| ret = blk_throtl_init(q); |
| if (ret) { |
| spin_lock_irq(q->queue_lock); |
| @@ -1161,6 +1159,13 @@ int blkcg_init_queue(struct request_queu |
| spin_unlock_irq(q->queue_lock); |
| } |
| return ret; |
| + |
| +err_unlock: |
| + spin_unlock_irq(q->queue_lock); |
| + rcu_read_unlock(); |
| + if (preloaded) |
| + radix_tree_preload_end(); |
| + return PTR_ERR(blkg); |
| } |
| |
| /** |