Commit 1cf7ad3c authored Jul 20, 2022 by Yang Yang Committed by Yongqiang Liu Jul 20, 2022

blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue

mainline inclusion
from mainline-v5.10-rc1
commit 47ce030b
category: bugfix
bugzilla: 186769, https://gitee.com/openeuler/kernel/issues/I5FYJY


CVE: NA

--------------------------------

blk_exit_queue will free elevator_data, while blk_mq_run_work_fn
will access it. Move cancel of hctx->run_work to the front of
blk_exit_queue to avoid use-after-free.

Fixes: 1b97871b ("blk-mq: move cancel of hctx->run_work into blk_mq_hw_sysfs_release")
Signed-off-by: Yang Yang <yang.yang@vivo.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Jason Yan <yanaijie@huawei.com>
Reviewed-by: Jason Yan <yanaijie@huawei.com>
Signed-off-by: Yongqiang Liu <liuyongqiang13@huawei.com>

parent b8493652

block/blk-mq-sysfs.c

+0 −2

Original line number	Diff line number	Diff line
		@@ -35,8 +35,6 @@ static void blk_mq_hw_sysfs_release(struct kobject *kobj)
		struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx,
		kobj);

		cancel_delayed_work_sync(&hctx->run_work);

		if (hctx->flags & BLK_MQ_F_BLOCKING)
		cleanup_srcu_struct(hctx->srcu);
		blk_free_flush_queue(hctx->fq);

block/blk-sysfs.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -837,9 +837,16 @@ static void __blk_release_queue(struct work_struct *work)

		blk_free_queue_stats(q->stats);

		if (q->mq_ops)
		if (q->mq_ops) {
		struct blk_mq_hw_ctx *hctx;
		int i;

		cancel_delayed_work_sync(&q->requeue_work);

		queue_for_each_hw_ctx(q, hctx, i)
		cancel_delayed_work_sync(&hctx->run_work);
		}

		blk_exit_rl(q, &q->root_rl);

		if (q->queue_tags)