Commit bbfc3c5d authored Jan 31, 2017 by Tahsin Erdogan Committed by Jens Axboe Feb 01, 2017

block: queue lock must be acquired when iterating over rls



blk_set_queue_dying() does not acquire queue lock before it calls
blk_queue_for_each_rl(). This allows a racing blkg_destroy() to
remove blkg->q_node from the linked list and have
blk_queue_for_each_rl() loop infitely over the removed blkg->q_node
list node.

Signed-off-by: Tahsin Erdogan <tahsin@google.com>
Signed-off-by: Jens Axboe <axboe@fb.com>

parent 5fad1b64

block/blk-core.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -527,12 +527,14 @@ void blk_set_queue_dying(struct request_queue *q)
		else {
		struct request_list *rl;

		spin_lock_irq(q->queue_lock);
		blk_queue_for_each_rl(rl, q) {
		if (rl->rq_pool) {
		wake_up(&rl->wait[BLK_RW_SYNC]);
		wake_up(&rl->wait[BLK_RW_ASYNC]);
		}
		}
		spin_unlock_irq(q->queue_lock);
		}
		}
		EXPORT_SYMBOL_GPL(blk_set_queue_dying);