Commit e869b546 authored Apr 26, 2017 by Bart Van Assche Committed by Jens Axboe Apr 26, 2017

blk-mq: Unregister debugfs attributes earlier



We currently call blk_mq_free_queue() from blk_cleanup_queue()
before we unregister the debugfs attributes for that queue in
blk_release_queue(). This leaves a window open during which
accessing most of the mq debugfs attributes would cause a
use-after-free. Additionally, the "state" attribute allows
running the queue, which we should not do after the queue has
entered the "dead" state. Fix both cases by unregistering the
debugfs attributes before freeing queue resources starts.

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Omar Sandoval <osandov@fb.com>
Signed-off-by: Jens Axboe <axboe@fb.com>

parent f05d1ba7

block/blk-core.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -563,9 +563,13 @@ void blk_cleanup_queue(struct request_queue *q)
		* prevent that q->request_fn() gets invoked after draining finished.
		*/
		blk_freeze_queue(q);
		if (!q->mq_ops) {
		spin_lock_irq(lock);
		if (!q->mq_ops)
		__blk_drain_queue(q, true);
		} else {
		blk_mq_debugfs_unregister_mq(q);
		spin_lock_irq(lock);
		}
		queue_flag_set(QUEUE_FLAG_DEAD, q);
		spin_unlock_irq(lock);

Admin message