Commit 5fd7a84a authored by Ming Lei's avatar Ming Lei Committed by Jens Axboe
Browse files

blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none 



elevator can be tore down by sysfs switch interface or disk release, so
hold ->sysfs_lock before referring to q->elevator, then potential
use-after-free can be avoided.

Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20220616014401.817001-2-ming.lei@redhat.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 14dc7a18

block/blk-mq.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -4440,12 +4440,14 @@ static bool blk_mq_elv_switch_none(struct list_head *head, 
	if (!qe)

	if (!qe)

		return false;

		return false;





	/* q->elevator needs protection from ->sysfs_lock */

	mutex_lock(&q->sysfs_lock);



	INIT_LIST_HEAD(&qe->node);

	INIT_LIST_HEAD(&qe->node);

	qe->q = q;

	qe->q = q;

	qe->type = q->elevator->type;

	qe->type = q->elevator->type;

	list_add(&qe->node, head);

	list_add(&qe->node, head);





	mutex_lock(&q->sysfs_lock);

	/*

	/*

	 * After elevator_switch_mq, the previous elevator_queue will be

	 * After elevator_switch_mq, the previous elevator_queue will be

	 * released by elevator_release. The reference of the io scheduler

	 * released by elevator_release. The reference of the io scheduler