diff options
| author | Bart Van Assche <bart.vanassche@wdc.com> | 2018-02-28 10:15:33 -0800 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2018-02-28 12:23:35 -0700 |
| commit | a063057d7c731cffa7d10740e8ebc2970df8dbb3 (patch) | |
| tree | 40895bc044e82ff993d698128c5b24f6d0c82c0a /block/blk-sysfs.c | |
| parent | 498f6650aec864e331cae7575fec5f07781d0bf3 (diff) | |
| download | linux-0-day-a063057d7c731cffa7d10740e8ebc2970df8dbb3.tar.gz linux-0-day-a063057d7c731cffa7d10740e8ebc2970df8dbb3.tar.xz | |
block: Fix a race between request queue removal and the block cgroup controller
Avoid that the following race can occur:
blk_cleanup_queue() blkcg_print_blkgs()
spin_lock_irq(lock) (1) spin_lock_irq(blkg->q->queue_lock) (2,5)
q->queue_lock = &q->__queue_lock (3)
spin_unlock_irq(lock) (4)
spin_unlock_irq(blkg->q->queue_lock) (6)
(1) take driver lock;
(2) busy loop for driver lock;
(3) override driver lock with internal lock;
(4) unlock driver lock;
(5) can take driver lock now;
(6) but unlock internal lock.
This change is safe because only the SCSI core and the NVME core keep
a reference on a request queue after having called blk_cleanup_queue().
Neither driver accesses any of the removed data structures between its
blk_cleanup_queue() and blk_put_queue() calls.
Reported-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Jan Kara <jack@suse.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block/blk-sysfs.c')
| -rw-r--r-- | block/blk-sysfs.c | 7 |
1 files changed, 0 insertions, 7 deletions
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index cbea895a55477..fd71a00c9462a 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -798,13 +798,6 @@ static void __blk_release_queue(struct work_struct *work) if (test_bit(QUEUE_FLAG_POLL_STATS, &q->queue_flags)) blk_stat_remove_callback(q, q->poll_cb); blk_stat_free_callback(q->poll_cb); - bdi_put(q->backing_dev_info); - blkcg_exit_queue(q); - - if (q->elevator) { - ioc_clear_queue(q); - elevator_exit(q, q->elevator); - } blk_free_queue_stats(q->stats); |