From: Tahsin Erdogan <tahsin@google.com>
Date: Wed, 1 Feb 2017 06:36:50 +0000 (-0800)
Subject: block: queue lock must be acquired when iterating over rls
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=bbfc3c5d6c7882dc65c1230e781644e35c29839f;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

block: queue lock must be acquired when iterating over rls

blk_set_queue_dying() does not acquire queue lock before it calls
blk_queue_for_each_rl(). This allows a racing blkg_destroy() to
remove blkg->q_node from the linked list and have
blk_queue_for_each_rl() loop infitely over the removed blkg->q_node
list node.

Signed-off-by: Tahsin Erdogan <tahsin@google.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
---

diff --git a/block/blk-core.c b/block/blk-core.c
index 02833ce5664e..b2df55a65250 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -527,12 +527,14 @@ void blk_set_queue_dying(struct request_queue *q)
 	else {
 		struct request_list *rl;
 
+		spin_lock_irq(q->queue_lock);
 		blk_queue_for_each_rl(rl, q) {
 			if (rl->rq_pool) {
 				wake_up(&rl->wait[BLK_RW_SYNC]);
 				wake_up(&rl->wait[BLK_RW_ASYNC]);
 			}
 		}
+		spin_unlock_irq(q->queue_lock);
 	}
 }
 EXPORT_SYMBOL_GPL(blk_set_queue_dying);