Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1571281 > unrolled thread
| Started by | Tahsin Erdogan <tahsin@google.com> |
|---|---|
| First post | 2017-02-01 07:40 +0100 |
| Last post | 2017-02-01 23:40 +0100 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH] block: queue lock must be acquired when iterating over rls Tahsin Erdogan <tahsin@google.com> - 2017-02-01 07:40 +0100
Re: [PATCH] block: queue lock must be acquired when iterating over rls Jens Axboe <axboe@kernel.dk> - 2017-02-01 23:40 +0100
| From | Tahsin Erdogan <tahsin@google.com> |
|---|---|
| Date | 2017-02-01 07:40 +0100 |
| Subject | [PATCH] block: queue lock must be acquired when iterating over rls |
| Message-ID | <t5WKd-2n7-7@gated-at.bofh.it> |
blk_set_queue_dying() does not acquire queue lock before it calls
blk_queue_for_each_rl(). This allows a racing blkg_destroy() to
remove blkg->q_node from the linked list and have
blk_queue_for_each_rl() loop infitely over the removed blkg->q_node
list node.
Signed-off-by: Tahsin Erdogan <tahsin@google.com>
---
block/blk-core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/block/blk-core.c b/block/blk-core.c
index 61ba08c58b64..0488a2b55bf0 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -525,12 +525,14 @@ void blk_set_queue_dying(struct request_queue *q)
else {
struct request_list *rl;
+ spin_lock_irq(q->queue_lock);
blk_queue_for_each_rl(rl, q) {
if (rl->rq_pool) {
wake_up(&rl->wait[BLK_RW_SYNC]);
wake_up(&rl->wait[BLK_RW_ASYNC]);
}
}
+ spin_unlock_irq(q->queue_lock);
}
}
EXPORT_SYMBOL_GPL(blk_set_queue_dying);
--
2.11.0.483.g087da7b7c-goog
[toc] | [next] | [standalone]
| From | Jens Axboe <axboe@kernel.dk> |
|---|---|
| Date | 2017-02-01 23:40 +0100 |
| Subject | Re: [PATCH] block: queue lock must be acquired when iterating over rls |
| Message-ID | <t6bJf-3KV-13@gated-at.bofh.it> |
| In reply to | #1571281 |
On 01/31/2017 10:36 PM, Tahsin Erdogan wrote: > blk_set_queue_dying() does not acquire queue lock before it calls > blk_queue_for_each_rl(). This allows a racing blkg_destroy() to > remove blkg->q_node from the linked list and have > blk_queue_for_each_rl() loop infitely over the removed blkg->q_node > list node. Thanks, applied. -- Jens Axboe
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web