Received: by 2002:a05:6358:1087:b0:cb:c9d3:cd90 with SMTP id j7csp3954639rwi; Sat, 22 Oct 2022 02:50:16 -0700 (PDT) X-Google-Smtp-Source: AMsMyM7khtClyxcGLZ1FB+cDKshB+sCpEwuCcbgYhq1mVF0nxkVgeodMe/vNj+uoAA4V4xMUaP0O X-Received: by 2002:a63:5f03:0:b0:460:b08a:8c00 with SMTP id t3-20020a635f03000000b00460b08a8c00mr19392687pgb.142.1666432216584; Sat, 22 Oct 2022 02:50:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666432216; cv=none; d=google.com; s=arc-20160816; b=jUSGKrLhiHi/3/daKgGuTSbCavvExI0gIxiuYYTWNpPykJp3icW6UTZdLLOjivNyv5 9qlmLSvSfXERKU8kCHekTuHGYctLN7I9DQkNFWbyQgZEcy7EvStRCU4XN3I/nndrttwz amEcydqbHfypuIQNQyKMl3JiPTD0v+UJtcI7UfIF3yiUXBmq8xkFtKyxvAxoVFxrZ1el YdHMKj4UBJ2FyOUemq9hV0IzBKdTP1XIQg0G4RXZqYX0rLMoOEboI5jzAZfT7NeX5KZN 0rPGY1cjDwAimK8JrEMo3BJjTX79YBLHZqbQYbzGpoAFShNCiSDrCGNWSIxKK10peT2U 0djw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=7Ulbx8um7lvDbi8Ta7RT4vSg4brgP/pVSDqTwFOQ7/A=; b=aychC9Q6xA6cPCzfTP8FvWlCs9p9SJoLEpZHWVYiV8zYTqkRAM0BaE7lJwXMnzZ4Jv cCU++L970DRfxFDk070zMVGkOC2jRKejFMocq2cLgehmpMSWwFSc7WyM4v1nQQHd8t0f NJgNGJZXKxutXqXQ+2YMiW5AwROjkKDB3w84x3VXLK0wicI4OT39SU5mF1NasaHwZwiG GekQYRDkVMA2e9vdPAnq9D85Nb6RBGFTR9UO2Z0sXNH/gBaFyvmg6ttQb8/qwa/MyLYb VTtsnWsKbtx6GUMPNWMMRWnnta0rKmFFOrd2neUlbUOo1vqZYVI0BilCz8RlEXWav6to ZD3Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=HoqePaSx; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id z5-20020a63c045000000b0043af57e5d16si25611970pgi.724.2022.10.22.02.50.03; Sat, 22 Oct 2022 02:50:16 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=HoqePaSx; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234680AbiJVIsk (ORCPT + 99 others); Sat, 22 Oct 2022 04:48:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41152 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234626AbiJVIpc (ORCPT ); Sat, 22 Oct 2022 04:45:32 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B16763B457; Sat, 22 Oct 2022 01:09:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 357D460B85; Sat, 22 Oct 2022 08:08:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3BD52C433D7; Sat, 22 Oct 2022 08:08:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666426102; bh=kFJ+68vFEX0M25SGmCiYdFlHCyOt1Ygv0k446d8yBno=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HoqePaSxcfa8AMSSvjWDTG103ft27CRjTrMv6y+PxbxdDPa006dF9gNlSam3mNe5N TDXkIAlL3F3Pk7Dvq7tU32HUMLmlQYIM7+ueSGs8ga+aOA6qDKam2X5oF99dM6gHPb ILdhTS36mHWJ2QxWprcORLH7XgcVXbXlXxtTicSc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Keith Busch , Ming Lei , Christoph Hellwig , Jens Axboe , Sasha Levin Subject: [PATCH 5.19 689/717] blk-mq: use quiesced elevator switch when reinitializing queues Date: Sat, 22 Oct 2022 09:29:28 +0200 Message-Id: <20221022072528.980696498@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221022072415.034382448@linuxfoundation.org> References: <20221022072415.034382448@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Keith Busch [ Upstream commit 8237c01f1696bc53c470493bf1fe092a107648a6 ] The hctx's run_work may be racing with the elevator switch when reinitializing hardware queues. The queue is merely frozen in this context, but that only prevents requests from allocating and doesn't stop the hctx work from running. The work may get an elevator pointer that's being torn down, and can result in use-after-free errors and kernel panics (example below). Use the quiesced elevator switch instead, and make the previous one static since it is now only used locally. nvme nvme0: resetting controller nvme nvme0: 32/0/0 default/read/poll queues BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 80000020c8861067 P4D 80000020c8861067 PUD 250f8c8067 PMD 0 Oops: 0000 [#1] SMP PTI Workqueue: kblockd blk_mq_run_work_fn RIP: 0010:kyber_has_work+0x29/0x70 ... Call Trace: __blk_mq_do_dispatch_sched+0x83/0x2b0 __blk_mq_sched_dispatch_requests+0x12e/0x170 blk_mq_sched_dispatch_requests+0x30/0x60 __blk_mq_run_hw_queue+0x2b/0x50 process_one_work+0x1ef/0x380 worker_thread+0x2d/0x3e0 Signed-off-by: Keith Busch Reviewed-by: Ming Lei Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220927155652.3260724-1-kbusch@fb.com Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin --- block/blk-mq.c | 6 +++--- block/blk.h | 3 +-- block/elevator.c | 4 ++-- 3 files changed, 6 insertions(+), 7 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 69d0a58f9e2f..302b8d92deef 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -4481,14 +4481,14 @@ static bool blk_mq_elv_switch_none(struct list_head *head, list_add(&qe->node, head); /* - * After elevator_switch_mq, the previous elevator_queue will be + * After elevator_switch, the previous elevator_queue will be * released by elevator_release. The reference of the io scheduler * module get by elevator_get will also be put. So we need to get * a reference of the io scheduler module here to prevent it to be * removed. */ __module_get(qe->type->elevator_owner); - elevator_switch_mq(q, NULL); + elevator_switch(q, NULL); mutex_unlock(&q->sysfs_lock); return true; @@ -4520,7 +4520,7 @@ static void blk_mq_elv_switch_back(struct list_head *head, kfree(qe); mutex_lock(&q->sysfs_lock); - elevator_switch_mq(q, t); + elevator_switch(q, t); mutex_unlock(&q->sysfs_lock); } diff --git a/block/blk.h b/block/blk.h index 0d6668663ab5..af2aaea23966 100644 --- a/block/blk.h +++ b/block/blk.h @@ -260,8 +260,7 @@ bool blk_bio_list_merge(struct request_queue *q, struct list_head *list, void blk_insert_flush(struct request *rq); -int elevator_switch_mq(struct request_queue *q, - struct elevator_type *new_e); +int elevator_switch(struct request_queue *q, struct elevator_type *new_e); void elevator_exit(struct request_queue *q); int elv_register_queue(struct request_queue *q, bool uevent); void elv_unregister_queue(struct request_queue *q); diff --git a/block/elevator.c b/block/elevator.c index c319765892bb..bd71f0fc4e4b 100644 --- a/block/elevator.c +++ b/block/elevator.c @@ -588,7 +588,7 @@ void elv_unregister(struct elevator_type *e) } EXPORT_SYMBOL_GPL(elv_unregister); -int elevator_switch_mq(struct request_queue *q, +static int elevator_switch_mq(struct request_queue *q, struct elevator_type *new_e) { int ret; @@ -723,7 +723,7 @@ void elevator_init_mq(struct request_queue *q) * need for the new one. this way we have a chance of going back to the old * one, if the new one fails init for some reason. */ -static int elevator_switch(struct request_queue *q, struct elevator_type *new_e) +int elevator_switch(struct request_queue *q, struct elevator_type *new_e) { int err; -- 2.35.1