Several block drivers call alloc_disk() followed by put_disk() if
something fails before device_add_disk() is called without calling
blk_cleanup_queue(). Make sure that also for this scenario a request
queue is dissociated from the cgroup controller. This patch avoids
that loading the parport_pc, paride and pf drivers triggers the
following kernel crash:

BUG: KASAN: null-ptr-deref in pi_init+0x42e/0x580 [paride]
Read of size 4 at addr 0000000000000008 by task modprobe/744
Call Trace:
dump_stack+0x9a/0xeb
kasan_report+0x139/0x350
pi_init+0x42e/0x580 [paride]
pf_init+0x2bb/0x1000 [pf]
do_one_initcall+0x8e/0x405
do_init_module+0xd9/0x2f2
load_module+0x3ab4/0x4700
SYSC_finit_module+0x176/0x1a0
do_syscall_64+0xee/0x2b0
entry_SYSCALL_64_after_hwframe+0x42/0xb7

Reported-by: Alexandru Moise <00moses.alexande...@gmail.com>
Fixes: a063057d7c73 ("block: Fix a race between request queue removal and the 
block cgroup controller")
Signed-off-by: Bart Van Assche <bart.vanass...@wdc.com>
Cc: Alexandru Moise <00moses.alexande...@gmail.com>
Cc: Tejun Heo <t...@kernel.org>
---
 block/blk-sysfs.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index f8457d6f0190..2e134da78f82 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -788,11 +788,37 @@ static void blk_free_queue_rcu(struct rcu_head *rcu_head)
 static void __blk_release_queue(struct work_struct *work)
 {
        struct request_queue *q = container_of(work, typeof(*q), release_work);
+       struct blkcg_gq *gq;
 
        if (test_bit(QUEUE_FLAG_POLL_STATS, &q->queue_flags))
                blk_stat_remove_callback(q, q->poll_cb);
        blk_stat_free_callback(q->poll_cb);
 
+       if (!blk_queue_dead(q)) {
+               /*
+                * Last reference was dropped without having called
+                * blk_cleanup_queue().
+                */
+               WARN_ONCE(blk_queue_init_done(q),
+                         "request queue %p has been registered but 
blk_cleanup_queue() has not been called for that queue\n",
+                         q);
+               bdi_put(q->backing_dev_info);
+               blkcg_exit_queue(q);
+
+               if (q->elevator) {
+                       ioc_clear_queue(q);
+                       elevator_exit(q, q->elevator);
+               }
+       }
+
+       rcu_read_lock();
+       gq = blkg_lookup(&blkcg_root, q);
+       rcu_read_unlock();
+
+       WARN(gq,
+            "request queue %p is being released but it has not yet been 
removed from the blkcg controller\n",
+            q);
+
        blk_free_queue_stats(q->stats);
 
        blk_exit_rl(q, &q->root_rl);
-- 
2.16.2

Reply via email to