Commit 5c3d858c authored by Ming Lei's avatar Ming Lei Committed by Jens Axboe
Browse files

block: fail to show/store elevator sysfs attribute if elevator is dying 



Prepare for moving elv_register[unregister]_queue out of elevator_lock
& queue freezing, so we may have to call elv_unregister_queue() after
elevator ->exit() is called, then there is small window for user to
call into ->show()/store(), and user-after-free can be caused.

Fail to show/store elevator sysfs attribute if elevator is dying by
adding one new flag of ELEVATOR_FLAG_DYNG, which is protected by
elevator ->sysfs_lock.

Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarNilay Shroff <nilay@linux.ibm.com>
Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
Link: https://lore.kernel.org/r/20250505141805.2751237-20-ming.lei@redhat.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent e25ee50d

block/blk-mq-sched.c

+1 −0
Original line number Diff line number Diff line
@@ -551,5 +551,6 @@ void blk_mq_exit_sched(struct request_queue *q, struct elevator_queue *e) 
	if (e->type->ops.exit_sched)

		e->type->ops.exit_sched(e);

	blk_mq_sched_tags_teardown(q, flags);

	set_bit(ELEVATOR_FLAG_DYING, &q->elevator->flags);

	q->elevator = NULL;

}

block/elevator.c

+6 −4
Original line number Diff line number Diff line
@@ -418,13 +418,14 @@ elv_attr_show(struct kobject *kobj, struct attribute *attr, char *page) 
{

	const struct elv_fs_entry *entry = to_elv(attr);

	struct elevator_queue *e;

	ssize_t error;

	ssize_t error = -ENODEV;



	if (!entry->show)

		return -EIO;



	e = container_of(kobj, struct elevator_queue, kobj);

	mutex_lock(&e->sysfs_lock);

	if (!test_bit(ELEVATOR_FLAG_DYING, &e->flags))

		error = entry->show(e, page);

	mutex_unlock(&e->sysfs_lock);

	return error;
@@ -436,13 +437,14 @@ elv_attr_store(struct kobject *kobj, struct attribute *attr, 
{

	const struct elv_fs_entry *entry = to_elv(attr);

	struct elevator_queue *e;

	ssize_t error;

	ssize_t error = -ENODEV;



	if (!entry->store)

		return -EIO;



	e = container_of(kobj, struct elevator_queue, kobj);

	mutex_lock(&e->sysfs_lock);

	if (!test_bit(ELEVATOR_FLAG_DYING, &e->flags))

		error = entry->store(e, page, length);

	mutex_unlock(&e->sysfs_lock);

	return error;

block/elevator.h

+1 −0
Original line number Diff line number Diff line
@@ -121,6 +121,7 @@ struct elevator_queue 
};



#define ELEVATOR_FLAG_REGISTERED	0

#define ELEVATOR_FLAG_DYING		1



/*

 * block elevator interface