Commit 824afb9b authored May 08, 2025 by Ming Lei Committed by Jens Axboe May 08, 2025

block: move removing elevator after deleting disk->queue_kobj



When blk_unregister_queue() is called from add_disk() failure path,
there is race in registering/unregistering elevator queue kobject
from the two code paths, because commit 559dc111 ("block: move
elv_register[unregister]_queue out of elevator_lock") moves elevator
queue register/unregister out of elevator lock.

Fix the race by removing elevator after deleting disk->queue_kobj,
because kobject_del(&disk->queue_kobj) drains in-progress sysfs
show()/store() of all attributes.

Fixes: 559dc111 ("block: move elv_register[unregister]_queue out of elevator_lock")
Reported-by: Nilay Shroff <nilay@linux.ibm.com>
Suggested-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Link: https://lore.kernel.org/r/20250508085807.3175112-3-ming.lei@redhat.com


Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent 8336d18c

block/blk-sysfs.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -948,9 +948,6 @@ void blk_unregister_queue(struct gendisk *disk)
		blk_mq_sysfs_unregister(disk);
		blk_crypto_sysfs_unregister(disk);

		if (queue_is_mq(q))
		elevator_set_none(q);

		mutex_lock(&q->sysfs_lock);
		disk_unregister_independent_access_ranges(disk);
		mutex_unlock(&q->sysfs_lock);
		@@ -959,5 +956,8 @@ void blk_unregister_queue(struct gendisk *disk)
		kobject_uevent(&disk->queue_kobj, KOBJ_REMOVE);
		kobject_del(&disk->queue_kobj);

		if (queue_is_mq(q))
		elevator_set_none(q);

		blk_debugfs_remove(disk);
		}