From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sg-1-33.ptr.blmpb.com (sg-1-33.ptr.blmpb.com [118.26.132.33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C13B026ED25 for ; Thu, 15 Jan 2026 05:24:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=118.26.132.33 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768454693; cv=none; b=MPiI/UdkkzONG2yx2RPrkMdYpM5vsMQYJ31CQA5QFGsbU2ZOsDd3qnN74E7jlSmlc2hi//AGn5up8hDM8TUqhCTFhgmF5w04EnFSAY6covtNGTNFxZlPseT13w/CfXJlVyXoCS0fP1gtUX6CjLKHFipLyi5WGseiGXDKak4Bie4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768454693; c=relaxed/simple; bh=udqXm+27Da4QgLfqsQ8AYjGfU336UmclFiiWtl3OOmk=; h=Cc:Message-Id:To:Subject:Mime-Version:Content-Type:From:Date: In-Reply-To:References; b=Fm6cv+U6Fw9nsnhoaS07B95D9nl+aT2QpgOdcsVgtcrsnhlEm6uLqfNsKXrKXFXUG+XejWcBtTU159DOf0/4rOaB23edFPB200Ml+Bsl4VSC13CLWeNIRXMU74cF2oceb30GGSdlrKj2xgvPdvWRCRoKHlw2D2ZETR89La0WiV8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=fnnas.com; spf=pass smtp.mailfrom=fnnas.com; dkim=pass (2048-bit key) header.d=fnnas-com.20200927.dkim.feishu.cn header.i=@fnnas-com.20200927.dkim.feishu.cn header.b=BO/v8l4R; arc=none smtp.client-ip=118.26.132.33 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=fnnas.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=fnnas.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=fnnas-com.20200927.dkim.feishu.cn header.i=@fnnas-com.20200927.dkim.feishu.cn header.b="BO/v8l4R" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=s1; d=fnnas-com.20200927.dkim.feishu.cn; t=1768454678; h=from:subject:mime-version:from:date:message-id:subject:to:cc: reply-to:content-type:mime-version:in-reply-to:message-id; bh=pGbqDVxaaSoXeisy9oAv4kNo2B4S4W5koTiOhYTomKs=; b=BO/v8l4RCc8nzg9R4V2jGmXLFefTMIHla/yPxitsbomzjp5M40vYeG26L09awMybW5KWO/ itO9TTvpuYWVGE2HZTzUSQZbLtfIHIBYZ0i0DUthH6eTBl5ym6kNuyNQ9z1x8BtLU8ETMt jegOPoXGma0T3WO94wb8HD3aCHqzM8EmvUt+s2M5hOtZztchVJOh+25v+NJUcdqs6+L4Mg DxAv2I1S1KdkrsERD9kVzLxhsGmjQqxTJ3WN+1b/SB7z0Mf58eJBMXNkFao/uwVXF+b0JC 2Dg+vSlQGsmW70e6z63Pi+GkFzOcp9xDl3R6seI+mLzq/Vfu+F1RzO5svInNlw== Cc: , , , , , , , , Message-Id: <50d63ff3-97ef-499f-961d-cf6766a8028b@fnnas.com> X-Original-From: Yu Kuai X-Lms-Return-Path: Reply-To: yukuai@fnnas.com To: "Zheng Qixing" , , , , Subject: Re: [PATCH v2 2/3] blk-cgroup: skip dying blkg in blkcg_activate_policy() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable From: "Yu Kuai" Date: Thu, 15 Jan 2026 13:24:33 +0800 In-Reply-To: <20260113061035.1902522-3-zhengqixing@huaweicloud.com> Received: from [192.168.1.104] ([39.182.0.185]) by smtp.feishu.cn with ESMTPS; Thu, 15 Jan 2026 13:24:35 +0800 References: <20260113061035.1902522-1-zhengqixing@huaweicloud.com> <20260113061035.1902522-3-zhengqixing@huaweicloud.com> Content-Language: en-US User-Agent: Mozilla Thunderbird Hi, =E5=9C=A8 2026/1/13 14:10, Zheng Qixing =E5=86=99=E9=81=93: > From: Zheng Qixing > > When switching IO schedulers on a block device, blkcg_activate_policy() > can race with concurrent blkcg deletion, leading to a use-after-free in > rcu_accelerate_cbs. > > T1: T2: > blkg_destroy > kill(&blkg->refcnt) // blkg->refcnt=3D1->0 > blkg_release // call_rcu(__blkg_release) > ... > blkg_free_workfn > ->pd_free_fn(pd) > elv_iosched_store > elevator_switch > ... > iterate blkg list > blkg_get(blkg) // blkg->refcnt=3D0->1 > list_del_init(&blkg->q_node) > blkg_put(pinned_blkg) // blkg->refcnt=3D1->0 > blkg_release // call_rcu again > rcu_accelerate_cbs // uaf > > Fix this by replacing blkg_get() with blkg_tryget(), which fails if > the blkg's refcount has already reached zero. If blkg_tryget() fails, > skip processing this blkg since it's already being destroyed. > > Link: https://lore.kernel.org/all/20260108014416.3656493-4-zhengqixing@hu= aweicloud.com/ > Fixes: f1c006f1c685 ("blk-cgroup: synchronize pd_free_fn() from blkg_free= _workfn() and blkcg_deactivate_policy()") > Signed-off-by: Zheng Qixing > Reviewed-by: Christoph Hellwig > --- > block/blk-cgroup.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c > index 600f8c5843ea..5dbc107eec53 100644 > --- a/block/blk-cgroup.c > +++ b/block/blk-cgroup.c > @@ -1622,9 +1622,10 @@ int blkcg_activate_policy(struct gendisk *disk, co= nst struct blkcg_policy *pol) > * GFP_NOWAIT failed. Free the existing one and > * prealloc for @blkg w/ GFP_KERNEL. > */ > + if (!blkg_tryget(blkg)) > + continue; So, why this check is still before the pd_alloc_fn()? See blkg_destroy(), can you replace this by the same checking: list_for_each_entry_reverse() if (hlist_unhashed(&blkg->blkcg_node)) continue; if (blkg->pd[pol->plid]) continue; > if (pinned_blkg) > blkg_put(pinned_blkg); > - blkg_get(blkg); > pinned_blkg =3D blkg; > =20 > spin_unlock_irq(&q->queue_lock); --=20 Thansk, Kuai