Commit 3dbaacf6 authored by Ming Lei's avatar Ming Lei Committed by Jens Axboe
Browse files

blk-cgroup: wait for blkcg cleanup before initializing new disk 



When a queue is shared across disk rebind (e.g., SCSI unbind/bind), the
previous disk's blkcg state is cleaned up asynchronously via
disk_release() -> blkcg_exit_disk(). If the new disk's blkcg_init_disk()
runs before that cleanup finishes, we may overwrite q->root_blkg while
the old one is still alive, and radix_tree_insert() in blkg_create()
fails with -EEXIST because the old blkg entries still occupy the same
queue id slot in blkcg->blkg_tree. This causes the sd probe to fail
with -ENOMEM.

Fix it by waiting in blkcg_init_disk() for root_blkg to become NULL,
which indicates the previous disk's blkcg cleanup has completed.

Fixes: 1059699f ("block: move blkcg initialization/destroy into disk allocation/release handler")
Cc: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260311032837.2368714-1-ming.lei@redhat.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent daa6c798

block/blk-cgroup.c

+15 −0
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@ 
#include <linux/backing-dev.h>

#include <linux/slab.h>

#include <linux/delay.h>

#include <linux/wait_bit.h>

#include <linux/atomic.h>

#include <linux/ctype.h>

#include <linux/resume_user_mode.h>
@@ -611,6 +612,8 @@ static void blkg_destroy_all(struct gendisk *disk) 


	q->root_blkg = NULL;

	spin_unlock_irq(&q->queue_lock);



	wake_up_var(&q->root_blkg);

}



static void blkg_iostat_set(struct blkg_iostat *dst, struct blkg_iostat *src)
@@ -1498,6 +1501,18 @@ int blkcg_init_disk(struct gendisk *disk) 
	struct blkcg_gq *new_blkg, *blkg;

	bool preloaded;



	/*

	 * If the queue is shared across disk rebind (e.g., SCSI), the

	 * previous disk's blkcg state is cleaned up asynchronously via

	 * disk_release() -> blkcg_exit_disk(). Wait for that cleanup to

	 * finish (indicated by root_blkg becoming NULL) before setting up

	 * new blkcg state. Otherwise, we may overwrite q->root_blkg while

	 * the old one is still alive, and radix_tree_insert() in

	 * blkg_create() will fail with -EEXIST because the old entries

	 * still occupy the same queue id slot in blkcg->blkg_tree.

	 */

	wait_var_event(&q->root_blkg, !READ_ONCE(q->root_blkg));



	new_blkg = blkg_alloc(&blkcg_root, disk, GFP_KERNEL);

	if (!new_blkg)

		return -ENOMEM;