summaryrefslogtreecommitdiff
path: root/block
diff options
context:
space:
mode:
authorMing Lei <ming.lei@redhat.com>2022-06-16 04:43:59 +0300
committerJens Axboe <axboe@kernel.dk>2022-06-16 23:45:15 +0300
commit5fd7a84a09e640016fe106dd3e992f5210e23dc7 (patch)
tree9a9e375e7ad18f3d650f37756f701b486b3a436b /block
parent14dc7a18abbe4176f5626c13c333670da8e06aa1 (diff)
downloadlinux-5fd7a84a09e640016fe106dd3e992f5210e23dc7.tar.xz
blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none
elevator can be tore down by sysfs switch interface or disk release, so hold ->sysfs_lock before referring to q->elevator, then potential use-after-free can be avoided. Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://lore.kernel.org/r/20220616014401.817001-2-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block')
-rw-r--r--block/blk-mq.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 26a7f802d7ee..c13d03b2e17c 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4440,12 +4440,14 @@ static bool blk_mq_elv_switch_none(struct list_head *head,
if (!qe)
return false;
+ /* q->elevator needs protection from ->sysfs_lock */
+ mutex_lock(&q->sysfs_lock);
+
INIT_LIST_HEAD(&qe->node);
qe->q = q;
qe->type = q->elevator->type;
list_add(&qe->node, head);
- mutex_lock(&q->sysfs_lock);
/*
* After elevator_switch_mq, the previous elevator_queue will be
* released by elevator_release. The reference of the io scheduler