blk-throttle: fix null pointer dereference while throttling writeback IOs (53cfdc10) · Commits · 戴 / test

A null pointer dereference can occur when blkcg is removed manually with writeback IOs inflight. This is caused by the following case: Writeback kworker submit the bio and set bio->bi_cg_private to tg in blk_throtl_assoc_bio. Then we remove the block cgroup manually, the blkg and tg would be freed if there is no request inflight. When the submitted bio come back, blk_throtl_bio_endio() fetch the tg which was already freed. Fix this by increasing the refcount of blkg in funcion blk_throtl_assoc_bio() so that the blkg will not be freed until the bio_endio called. Reviewed-by:

Shaohua Li <shli@fb.com> Signed-off-by:

Jiufei Xue <jiufei.xjf@alibaba-inc.com> Signed-off-by:

Jens Axboe <axboe@kernel.dk>

block/blk-throttle.c

+10 −2

Original line number	Diff line number	Diff line
		@@ -2112,8 +2112,12 @@ static inline void throtl_update_latency_buckets(struct throtl_data *td)
		static void blk_throtl_assoc_bio(struct throtl_grp tg, struct bio bio)
		{
		#ifdef CONFIG_BLK_DEV_THROTTLING_LOW
		if (bio->bi_css)
		if (bio->bi_css) {
		if (bio->bi_cg_private)
		blkg_put(tg_to_blkg(bio->bi_cg_private));
		bio->bi_cg_private = tg;
		blkg_get(tg_to_blkg(tg));
		}
		blk_stat_set_issue(&bio->bi_issue_stat, bio_sectors(bio));
		#endif
		}
		@@ -2283,8 +2287,10 @@ void blk_throtl_bio_endio(struct bio *bio)

		start_time = blk_stat_time(&bio->bi_issue_stat) >> 10;
		finish_time = __blk_stat_time(finish_time_ns) >> 10;
		if (!start_time \|\| finish_time <= start_time)
		if (!start_time \|\| finish_time <= start_time) {
		blkg_put(tg_to_blkg(tg));
		return;
		}

		lat = finish_time - start_time;
		/* this is only for bio based driver */
		@@ -2314,6 +2320,8 @@ void blk_throtl_bio_endio(struct bio *bio)
		tg->bio_cnt /= 2;
		tg->bad_bio_cnt /= 2;
		}

		blkg_put(tg_to_blkg(tg));
		}
		#endif

Admin message