blk-mq: avoid to touch q->elevator without any protection
q->elevator is referred in blk_mq_has_sqsched() without any protection, no .q_usage_counter is held, no queue srcu and rcu read lock is held, so potential use-after-free may be triggered. Fix the issue by adding one queue flag for checking if the elevator uses single queue style dispatch. Meantime the elevator feature flag of ELEVATOR_F_MQ_AWARE isn't needed any more. Cc: Jan Kara <jack@suse.cz> Signed-off-by:Ming Lei <ming.lei@redhat.com> Reviewed-by:
Christoph Hellwig <hch@lst.de> Link: https://lore.kernel.org/r/20220616014401.817001-3-ming.lei@redhat.com Signed-off-by:
Jens Axboe <axboe@kernel.dk>
Showing
- block/bfq-iosched.c 3 additions, 0 deletionsblock/bfq-iosched.c
- block/blk-mq-sched.c 1 addition, 0 deletionsblock/blk-mq-sched.c
- block/blk-mq.c 2 additions, 16 deletionsblock/blk-mq.c
- block/kyber-iosched.c 2 additions, 1 deletionblock/kyber-iosched.c
- block/mq-deadline.c 3 additions, 0 deletionsblock/mq-deadline.c
- include/linux/blkdev.h 2 additions, 2 deletionsinclude/linux/blkdev.h
Loading
Please register or sign in to comment