Commit f40139fd authored by Ming Lei's avatar Ming Lei Committed by Jens Axboe
Browse files

ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd 



ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but
we may have scheduled task work via io_uring_cmd_complete_in_task() for
dispatching request, then kernel crash can be triggered.

Fix it by not trying to canceling the command if ublk block request is
started.

Fixes: 216c8f5e ("ublk: replace monitor with cancelable uring_cmd")
Reported-by: default avatarJared Holzman <jholzman@nvidia.com>
Tested-by: default avatarJared Holzman <jholzman@nvidia.com>
Closes: https://lore.kernel.org/linux-block/d2179120-171b-47ba-b664-23242981ef19@nvidia.com/


Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250425013742.1079549-3-ming.lei@redhat.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent d6aa0c17

drivers/block/ublk_drv.c

+21 −6
Original line number Diff line number Diff line
@@ -1683,14 +1683,31 @@ static void ublk_start_cancel(struct ublk_queue *ubq) 
	ublk_put_disk(disk);

}



static void ublk_cancel_cmd(struct ublk_queue *ubq, struct ublk_io *io,

static void ublk_cancel_cmd(struct ublk_queue *ubq, unsigned tag,

		unsigned int issue_flags)

{

	struct ublk_io *io = &ubq->ios[tag];

	struct ublk_device *ub = ubq->dev;

	struct request *req;

	bool done;



	if (!(io->flags & UBLK_IO_FLAG_ACTIVE))

		return;



	/*

	 * Don't try to cancel this command if the request is started for

	 * avoiding race between io_uring_cmd_done() and

	 * io_uring_cmd_complete_in_task().

	 *

	 * Either the started request will be aborted via __ublk_abort_rq(),

	 * then this uring_cmd is canceled next time, or it will be done in

	 * task work function ublk_dispatch_req() because io_uring guarantees

	 * that ublk_dispatch_req() is always called

	 */

	req = blk_mq_tag_to_rq(ub->tag_set.tags[ubq->q_id], tag);

	if (req && blk_mq_request_started(req))

		return;



	spin_lock(&ubq->cancel_lock);

	done = !!(io->flags & UBLK_IO_FLAG_CANCELED);

	if (!done)
@@ -1722,7 +1739,6 @@ static void ublk_uring_cmd_cancel_fn(struct io_uring_cmd *cmd, 
	struct ublk_uring_cmd_pdu *pdu = ublk_get_uring_cmd_pdu(cmd);

	struct ublk_queue *ubq = pdu->ubq;

	struct task_struct *task;

	struct ublk_io *io;



	if (WARN_ON_ONCE(!ubq))

		return;
@@ -1737,9 +1753,8 @@ static void ublk_uring_cmd_cancel_fn(struct io_uring_cmd *cmd, 
	if (!ubq->canceling)

		ublk_start_cancel(ubq);



	io = &ubq->ios[pdu->tag];

	WARN_ON_ONCE(io->cmd != cmd);

	ublk_cancel_cmd(ubq, io, issue_flags);

	WARN_ON_ONCE(ubq->ios[pdu->tag].cmd != cmd);

	ublk_cancel_cmd(ubq, pdu->tag, issue_flags);

}



static inline bool ublk_queue_ready(struct ublk_queue *ubq)
@@ -1752,7 +1767,7 @@ static void ublk_cancel_queue(struct ublk_queue *ubq) 
	int i;



	for (i = 0; i < ubq->q_depth; i++)

		ublk_cancel_cmd(ubq, &ubq->ios[i], IO_URING_F_UNLOCKED);

		ublk_cancel_cmd(ubq, i, IO_URING_F_UNLOCKED);

}



/* Cancel all pending commands, must be called after del_gendisk() returns */