diff options
| author | Yu Kuai <yukuai@fygo.io> | 2026-08-02 19:25:17 +0800 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-08-03 20:02:34 -0600 |
| commit | 9a916798946e5107472cdc714079c0167b8cd251 (patch) | |
| tree | 7292391ae6ebed0584856bc123c066f036c10fda /block | |
| parent | 3be7ad35f10e8e19f618f67ddca0bc0e247f6505 (diff) | |
blk-cgroup: protect q->blkg_list iteration in blkg_destroy_all() with blkcg_mutex
blkg_destroy_all() iterates q->blkg_list without holding blkcg_mutex,
which can race with blkg_free_workfn() that removes blkgs from the list
while holding blkcg_mutex.
Add blkcg_mutex protection around the q->blkg_list iteration to prevent
potential list corruption or use-after-free issues.
Reviewed-by: Tang Yizhou <yizhou.tang@shopee.com>
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Reviewed-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Link: https://patch.msgid.link/20260802112525.3933753-2-yukuai@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block')
| -rw-r--r-- | block/blk-cgroup.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index d9676126c5b5..eb0cfb10b859 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -569,6 +569,7 @@ static void blkg_destroy_all(struct gendisk *disk) int i; restart: + mutex_lock(&q->blkcg_mutex); spin_lock_irq(&q->queue_lock); list_for_each_entry(blkg, &q->blkg_list, q_node) { struct blkcg *blkcg = blkg->blkcg; @@ -587,6 +588,7 @@ restart: if (!(--count)) { count = BLKG_DESTROY_BATCH_SIZE; spin_unlock_irq(&q->queue_lock); + mutex_unlock(&q->blkcg_mutex); cond_resched(); goto restart; } @@ -606,6 +608,7 @@ restart: q->root_blkg = NULL; spin_unlock_irq(&q->queue_lock); + mutex_unlock(&q->blkcg_mutex); wake_up_var(&q->root_blkg); } |