From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta0.migadu.com (out-204.mta0.migadu.com [91.218.175.204]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 578493D45D5 for ; Thu, 20 Aug 2026 09:57:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.204 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787219858; cv=none; b=GIOvDkDtcV3fIrKXVK5zf/vnl1XzTV13gO/mUEFQHqJwGkv2fjMLaW0AoNeSAZ0QXLnAOVg4tUoaunDukY0i1bzrkfSL451gpo4BE46Ad/8PeuH8XH0mp2IMZxjBPxTed5XHSLYSa9LvYoyiWF6a8Ch4zG+xCsevEdak8sfV3/k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787219858; c=relaxed/simple; bh=Ue1KeQSz2mteuNE2tqZ3FqrKfVxgfsdrVc3CXv7GmXU=; h=From:To:Cc:Subject:Date:Message-Id; b=WiI/GKWFt6HF7r+CWxeM+1uzf4GUzI2EUkW3j/wAlf3CqibuQVxlJup5INd4edKXZ9z/bEvx27erCV8NkmclaGCtFHNrc5Ue7fUEddi2rl0J4yT4nJ692UeCVHrP6nFrMNtg176cbg6Vj6bYZB3YJCqmmNYkgTjAisxbtJS1EEQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=LiXAusRk; arc=none smtp.client-ip=91.218.175.204 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="LiXAusRk" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=Ue1KeQSz2mteuNE2tqZ3FqrKfVxgfsdrVc3CXv7GmXU=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787219853; v=1; x=1787824653; b=LiXAusRkjGlOEXxz1kslj6r5l9w5Ls63J5LUbjPDU/b8V3BtZxY6r8/+lZeTHaIExDFXlHym HxgJToeAVJ6/nYiX+AUGvmRFS6sul4CQv822MSWbkrgreg51SpMh4dVL9vcqkGxPSmpcC3LdF01 dkEBUDFYo0HSFTWEcrlB7N5g= X-Envelope-To: linux-kernel@vger.kernel.org Received: from MSCND1355B05.fareast.nevint.com (117.128.58.94) by smtp.migadu.com with ESMTPS id e23a4276c28904d2; Thu, 20 Aug 2026 09:57:23 +0000 X-Mizu-Trace-ID: e23a4276c28904d2 X-Migadu-Flow: FLOW_OUT From: Zqiang To: axboe@kernel.dk, tom.leiming@gmail.com Cc: linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, qiang.zhang@linux.dev Subject: [PATCH] blk-mq: Fix missed srcu_barrier() calls before cleanup_srcu_struct() Date: Thu, 20 Aug 2026 17:57:16 +0800 Message-Id: <20260820095716.21528-1-qiang.zhang@linux.dev> X-Mailer: git-send-email 2.17.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: In blk_mq_alloc_tag_set(), if blk_mq_alloc_set_map_and_rqs() fails after some hardware queues have already been allocated, its unwind path frees the partially allocated maps and tags through invoke the blk_mq_free_map_and_rqs()->blk_mq_free_tags(), which issues call_srcu() against set->tags_srcu. control then returns to blk_mq_alloc_tag_set() and falls through to the out_cleanup_tags_srcu label, which calls cleanup_srcu_struct() directly. Calling cleanup_srcu_struct() while call_srcu() callbacks are still outstanding is illegal, it triggers a WARN and tears down the srcu_struct while the pending blk_mq_free_tags_callback() still references it, leading to a use-after-free. The normal teardown path in blk_mq_free_tag_set() already guards against this by calling srcu_barrier() before cleanup_srcu_struct(), but the error path in blk_mq_alloc_tag_set() was missing the same barrier. this commit therefore also add srcu_barrier(&set->tags_srcu) call so that all outstanding SRCU callbacks complete before the srcu_struct is destroyed. Fixes: ad0d05dbddc1 ("blk-mq: Defer freeing of tags page_list to SRCU callback") Signed-off-by: Zqiang --- block/blk-mq.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/blk-mq.c b/block/blk-mq.c index 2c850330a32b..59cd629b37d5 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -4924,6 +4924,7 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set) } kfree(set->tags); set->tags = NULL; + srcu_barrier(&set->tags_srcu); out_cleanup_tags_srcu: cleanup_srcu_struct(&set->tags_srcu); out_cleanup_srcu: -- 2.17.1