From: Tejun Heo tj@kernel.org
commit b0814361a25cba73a224548843ed92d8ea78715a upstream.
blkcg_print_stat() iterates blkgs under RCU and doesn't test whether the blkg is online. This can call into pd_stat_fn() on a pd which is still being initialized leading to an oops.
The heaviest operation - recursively summing up rwstat counters - is already done while holding the queue_lock. Expand queue_lock to cover the other operations and skip the blkg if it isn't online yet. The online state is protected by both blkcg and queue locks, so this guarantees that only online blkgs are processed.
Signed-off-by: Tejun Heo tj@kernel.org Reported-by: Roman Gushchin guro@fb.com Cc: Josef Bacik jbacik@fb.com Fixes: 903d23f0a354 ("blk-cgroup: allow controllers to output their own stats") Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- block/blk-cgroup.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
--- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -908,9 +908,14 @@ static int blkcg_print_stat(struct seq_f int i; bool has_stats = false;
+ spin_lock_irq(&blkg->q->queue_lock); + + if (!blkg->online) + goto skip; + dname = blkg_dev_name(blkg); if (!dname) - continue; + goto skip;
/* * Hooray string manipulation, count is the size written NOT @@ -920,8 +925,6 @@ static int blkcg_print_stat(struct seq_f */ off += scnprintf(buf+off, size-off, "%s ", dname);
- spin_lock_irq(&blkg->q->queue_lock); - blkg_rwstat_recursive_sum(blkg, NULL, offsetof(struct blkcg_gq, stat_bytes), &rwstat); rbytes = rwstat.cnt[BLKG_RWSTAT_READ]; @@ -934,8 +937,6 @@ static int blkcg_print_stat(struct seq_f wios = rwstat.cnt[BLKG_RWSTAT_WRITE]; dios = rwstat.cnt[BLKG_RWSTAT_DISCARD];
- spin_unlock_irq(&blkg->q->queue_lock); - if (rbytes || wbytes || rios || wios) { has_stats = true; off += scnprintf(buf+off, size-off, @@ -973,6 +974,8 @@ static int blkcg_print_stat(struct seq_f seq_commit(sf, -1); } } + skip: + spin_unlock_irq(&blkg->q->queue_lock); }
rcu_read_unlock();