[PATCH] null_blk: reject blocking/memory-backed devices sharing non-blocking tag set

[Rohinthan P <rokinthanp03@gmail.com>]

When a null_blk device is configured via configfs with shared_tags=1
and memory_backed=1 (or blocking=1), null_validate_conf() sets
dev->blocking = true because memory-backed devices allocate memory
during request handling.

However, when dev->shared_tags is enabled, the device uses the global
tag_set. The global tag_set is initialized by null_init_global_tag_set()
according to the module parameter g_blocking. If the module was loaded
without blocking=1 (g_blocking == false, the default), the global
tag_set does not have BLK_MQ_F_BLOCKING set in tag_set.flags.

Consequently, blk_mq_run_dispatch_ops() dispatches requests holding an
RCU read lock (rcu_read_lock()) rather than SRCU. During I/O execution,
null_queue_rq() -> null_handle_memory_backed() -> null_insert_page()
calls null_alloc_page(), which invokes kmalloc(..., GFP_NOIO),
alloc_pages(GFP_NOIO, 0), and radix_tree_preload(GFP_NOIO). Because
GFP_NOIO can sleep, this triggers a sleeping-in-invalid-context bug:

    BUG: sleeping function called from invalid context at include/linux/sched/mm.h:322
    in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 6031
    RCU nest depth: 1, expected: 0
    1 lock held by syz-executor:
     #0: rcu_read_lock at blk_mq_dispatch_queue_requests
    Call Trace:
     dump_stack_lvl
     __might_resched
     might_alloc
     null_alloc_page drivers/block/null_blk/main.c:878
     null_insert_page drivers/block/null_blk/main.c:1027
     copy_to_nullb drivers/block/null_blk/main.c:1165
     null_handle_memory_backed drivers/block/null_blk/main.c:1388
     null_queue_rq drivers/block/null_blk/main.c:1711
     blk_mq_dispatch_queue_requests block/blk-mq.c:2872

Reject configurations in null_validate_conf() where a blocking or
memory-backed device attempts to share a non-blocking global tag set
(dev->shared_tags && dev->blocking && !g_blocking).

Fixes: 14509b748ff5 ("null_blk: add configfs variable shared_tags")
Reported-by: syzbot+95fdab36405e5ffdb680@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=95fdab36405e5ffdb680
Signed-off-by: Rohinthan P <rokinthanp03@gmail.com>
---
 drivers/block/null_blk/main.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index 4a9beec..64b8bee 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -1940,6 +1940,11 @@ static int null_validate_conf(struct nullb_device *dev)
 		return -EINVAL;
 	}
 
+	if (dev->shared_tags && dev->blocking && !g_blocking) {
+		pr_err("blocking/memory-backed devices cannot share non-blocking tag set\n");
+		return -EINVAL;
+	}
+
 	return 0;
 }
 
-- 
2.53.0