Commit 18bbaf0e authored by Ming Lei's avatar Ming Lei Committed by Wen Zhiwei
Browse files

block: avoid to reuse `hctx` not removed from cpuhp callback list 

stable inclusion
from stable-v6.6.69
commit ee18012c80155f6809522804099621070c69ec72
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBNEPJ

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ee18012c80155f6809522804099621070c69ec72



--------------------------------

commit 85672ca9ceeaa1dcf2777a7048af5f4aee3fd02b upstream.

If the 'hctx' isn't removed from cpuhp callback list, we can't reuse it,
otherwise use-after-free may be triggered.

Reported-by: default avatarkernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202412172217.b906db7c-lkp@intel.com


Tested-by: default avatarkernel test robot <oliver.sang@intel.com>
Fixes: 22465bbac53c ("blk-mq: move cpuhp callback registering out of q->sysfs_lock")
Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20241218101617.3275704-3-ming.lei@redhat.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarWen Zhiwei <wenzhiwei@kylinos.cn>
parent 5835353f

block/blk-mq.c

+10 −1
Original line number Diff line number Diff line
@@ -4376,6 +4376,15 @@ struct gendisk *blk_mq_alloc_disk_for_queue(struct request_queue *q, 
}

EXPORT_SYMBOL(blk_mq_alloc_disk_for_queue);



/*

 * Only hctx removed from cpuhp list can be reused

 */

static bool blk_mq_hctx_is_reusable(struct blk_mq_hw_ctx *hctx)

{

	return hlist_unhashed(&hctx->cpuhp_online) &&

		hlist_unhashed(&hctx->cpuhp_dead);

}



static struct blk_mq_hw_ctx *blk_mq_alloc_and_init_hctx(

		struct blk_mq_tag_set *set, struct request_queue *q,

		int hctx_idx, int node)
@@ -4385,7 +4394,7 @@ static struct blk_mq_hw_ctx *blk_mq_alloc_and_init_hctx( 
	/* reuse dead hctx first */

	spin_lock(&q->unused_hctx_lock);

	list_for_each_entry(tmp, &q->unused_hctx_list, hctx_list) {

		if (tmp->numa_node == node) {

		if (tmp->numa_node == node && blk_mq_hctx_is_reusable(tmp)) {

			hctx = tmp;

			break;

		}