【5.10】修复queue hctx并发问题

1. 问题描述及根因：
blk_mq_realloc_hw_ctxs() will free the 'queue_hw_ctx'(e.g. undate
submit_queues through configfs for null_blk), while it might still be
used from other context(e.g. switch elevator to none):

t1					t2
elevator_switch
 blk_mq_unquiesce_queue
  blk_mq_run_hw_queues
   queue_for_each_hw_ctx
    // assembly code for hctx = (q)->queue_hw_ctx[i]
    mov    0x48(%rbp),%rdx -> read old queue_hw_ctx

__blk_mq_update_nr_hw_queues
					 blk_mq_realloc_hw_ctxs
					  hctxs = q->queue_hw_ctx
					  q->queue_hw_ctx = new_hctxs
					  kfree(hctxs)
    movslq %ebx,%rax
    mov    (%rdx,%rax,8),%rdi ->uaf

2. 当前存在主线方案：
https://patchwork.kernel.org/project/linux-block/cover/20220308073219.91173-1-ming.lei@redhat.com/
但是当前方案影响kabi变更；

3. 自研方案新增：本次合入

4、问题复现
复现步骤：
1. blk_mq_run_hw_queues位置增加延时（足够大，大到有时间调整参数），打印延时前后地址；
2. 切换调度器到none， 命中调度器切换分支；
3. config fs修改submit_queue参数，变大，不超过64即可；

复现代码及结果
  6 ---
  7  block/blk-mq.c                | 22 +++++++++++++++++++++-
  8  drivers/block/null_blk_main.c |  3 ++-
  9  2 files changed, 23 insertions(+), 2 deletions(-)
 10 
 11 diff --git a/block/blk-mq.c b/block/blk-mq.c
 12 index c3beaca1f4fb..45728f989e30 100644
 13 --- a/block/blk-mq.c
 14 +++ b/block/blk-mq.c
 15 @@ -1712,6 +1712,8 @@ static struct blk_mq_hw_ctx *blk_mq_get_sq_hctx(struct request_queue *q)
 16         return NULL;
 17  }
 18 
 19 +bool time_flag = true;
 20 +unsigned long long timeout;
 21  /**
 22   * blk_mq_run_hw_queues - Run all hardware queues in a request queue.
 23   * @q: Pointer to the request queue to run.
 24 @@ -1722,10 +1724,26 @@ void blk_mq_run_hw_queues(struct request_queue *q, bool async)
 25         struct blk_mq_hw_ctx *hctx, *sq_hctx;
 26         int i;
 27 
 28 +       if (time_flag) {
 29 +               timeout = jiffies;
 30 +               time_flag = false;
 31 +       }
 32 +       bool flag = true;
 33 +       printk("time %lx %lx\n", jiffies, timeout + 50*HZ);
 34 +       if (jiffies > timeout + 50*HZ) {
 35 +               flag = false;
 36 +       }
 37 +
 38         sq_hctx = NULL;
 39         if (blk_mq_has_sqsched(q))
 40                 sq_hctx = blk_mq_get_sq_hctx(q);
 41         queue_for_each_hw_ctx(q, hctx, i) {
 42 +               if (!flag) {
 43 +                       printk("debug start %llx\n", hctx);
 44 +                       msleep(10000);
 45 +                       printk("debug end %llx\n", hctx);
 46 +               }
 47 +
 48                 if (blk_mq_hctx_stopped(hctx))
 49                         continue;
 50                 /*
 51 @@ -3264,7 +3282,9 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
 52  {
 53         int i, j, end;
 54         struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx;
 55 -
"0001-debug-for-hctxs.patch" 81L, 2475C

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识