Commit 4faa3c81 authored by Fabio Checconi's avatar Fabio Checconi Committed by Jens Axboe

cfq-iosched: do not leak ioc_data across iosched switches

When switching scheduler from cfq, cfq_exit_queue() does not clear
ioc->ioc_data, leaving a dangling pointer that can deceive the following
lookups when the iosched is switched back to cfq.  The pattern that can
trigger that is the following:

    - elevator switch from cfq to something else;
    - module unloading, with elv_unregister() that calls cfq_free_io_context()
      on ioc freeing the cic (via the .trim op);
    - module gets reloaded and the elevator switches back to cfq;
    - reallocation of a cic at the same address as before (with a valid key).

To fix it just assign NULL to ioc_data in __cfq_exit_single_io_context(),
that is called from the regular exit path and from the elevator switching
code.  The only path that frees a cic and is not covered is the error handling
one, but cic's freed in this way are never cached in ioc_data.
Signed-off-by: default avatarFabio Checconi <fabio@gandalf.sssup.it>
Signed-off-by: default avatarJens Axboe <jens.axboe@oracle.com>
parent 8191ecd1
...@@ -1214,6 +1214,8 @@ static void cfq_exit_cfqq(struct cfq_data *cfqd, struct cfq_queue *cfqq) ...@@ -1214,6 +1214,8 @@ static void cfq_exit_cfqq(struct cfq_data *cfqd, struct cfq_queue *cfqq)
static void __cfq_exit_single_io_context(struct cfq_data *cfqd, static void __cfq_exit_single_io_context(struct cfq_data *cfqd,
struct cfq_io_context *cic) struct cfq_io_context *cic)
{ {
struct io_context *ioc = cic->ioc;
list_del_init(&cic->queue_list); list_del_init(&cic->queue_list);
/* /*
...@@ -1223,6 +1225,9 @@ static void __cfq_exit_single_io_context(struct cfq_data *cfqd, ...@@ -1223,6 +1225,9 @@ static void __cfq_exit_single_io_context(struct cfq_data *cfqd,
cic->dead_key = (unsigned long) cic->key; cic->dead_key = (unsigned long) cic->key;
cic->key = NULL; cic->key = NULL;
if (ioc->ioc_data == cic)
rcu_assign_pointer(ioc->ioc_data, NULL);
if (cic->cfqq[ASYNC]) { if (cic->cfqq[ASYNC]) {
cfq_exit_cfqq(cfqd, cic->cfqq[ASYNC]); cfq_exit_cfqq(cfqd, cic->cfqq[ASYNC]);
cic->cfqq[ASYNC] = NULL; cic->cfqq[ASYNC] = NULL;
...@@ -1255,7 +1260,6 @@ static void cfq_exit_single_io_context(struct io_context *ioc, ...@@ -1255,7 +1260,6 @@ static void cfq_exit_single_io_context(struct io_context *ioc,
*/ */
static void cfq_exit_io_context(struct io_context *ioc) static void cfq_exit_io_context(struct io_context *ioc)
{ {
rcu_assign_pointer(ioc->ioc_data, NULL);
call_for_each_cic(ioc, cfq_exit_single_io_context); call_for_each_cic(ioc, cfq_exit_single_io_context);
} }
...@@ -1478,8 +1482,7 @@ cfq_drop_dead_cic(struct cfq_data *cfqd, struct io_context *ioc, ...@@ -1478,8 +1482,7 @@ cfq_drop_dead_cic(struct cfq_data *cfqd, struct io_context *ioc,
spin_lock_irqsave(&ioc->lock, flags); spin_lock_irqsave(&ioc->lock, flags);
if (ioc->ioc_data == cic) BUG_ON(ioc->ioc_data == cic);
rcu_assign_pointer(ioc->ioc_data, NULL);
radix_tree_delete(&ioc->radix_root, (unsigned long) cfqd); radix_tree_delete(&ioc->radix_root, (unsigned long) cfqd);
hlist_del_rcu(&cic->cic_list); hlist_del_rcu(&cic->cic_list);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment