From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id E4B838017D for ; Mon, 2 Nov 2026 16:42:40 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A2GfOBZ026940; Mon, 2 Nov 2026 19:41:25 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A2GfOBZ026940 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=default; t=1793637687; bh=HPhnuQ/OcReXPBpiwMso9YT4L1vRtijkTHymNjVF8gM=; h=From:To:Date:In-Reply-To:References:Cc:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe; b=nZcWl7cFpqCSOJkXZeuBO9F96aZeR2c5Imz33YujNC9644x8MIJ5K+iUM+jdmyXP+ s0uGrFf60OIsJ8JPR+Atz/L0TedeGVb3dvJDSh+/osKLipif/UGg2FkwsEbaGNqOjz Bx6goVHxjy8PqExDIjiC5nSY/I0KTvIAYWIgfcPhRaCq/lLtFbv3XBe3VNyiisktXp rnm7ogOKHH+3nDlfUJmurIco0AWc72sNbhhZspeF6+VwnakTGv7ENGJVp0rEhm1NH1 QhJnBiXbSHFyeMwUFheylM0InYEaPgNYo9i4Un1mLQcR03cTaLSzHTpfkUF9Jhl06U St7U0I2vEGe/Q== Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A2GfNTi026936 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 2 Nov 2026 19:41:23 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A2GfNTi026936 Authentication-Results: mail.openvz.org; dkim=pass (2048-bit key) header.d=openvz.org header.i=@openvz.org header.b="I7EWHYRO" Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-48e0af48c18so2381806f8f.2 for ; Mon, 02 Nov 2026 08:41:23 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBzBmCHfz4RThGoe4ADliqorFTtx9day3p4mhcNL2ChTmNevmmYBpUqfKqVlYFgCzZ+YfSARYA==@openvz.org X-Gm-Message-State: APuU4Z8y0DxBGd1uIJ/KoH876WUTydcfLKESFJp3X3ZUdfWVpmsqwJdM dND5OV4+g9EdUs6etL6w6tgDZTvXWQEGx11Pb2dDZlGHYuddSD1geGpKvo4hiJIceEU6ioifLd4 H1auJVe0QMYm+DSDy17b3nRs8n2NNbFrwvzbGhBGIO4oyQTNpqJfXjQ== X-Gm-Gg: AYBFou2CrEYIjwhcXxX1kz+4NUyEvwPkwm2E1s8f9THFSO/ZG6MieEMqdXSh876gy0I pXkWGTZHdNLKK4di+YMjxZXg86GSQbSAVxY8/30X6GNj8PJSbgv49BbD+p+HdKPZ68JH1cdaho6 Lzk1M6hU7iqecN2Fe41m1RzqR+6lzHO/ukfSqQtIJbjhnNKny651t4mbqf2IIPuByVFGjeSHSUG ra11xQirq/xFNx+dLq0Q/RL9HN7EAawIR7FodYsXqlsGgWSglYZegI1EEcWGflvbqY9kf4EOtPy SVRAl+D/cA== X-Received: by 2002:a05:600c:8b6a:b0:4a1:f720:74cd with SMTP id 5b1f17b1804b1-4ac18c73d01mr234609375e9.24.1793635945276; Mon, 02 Nov 2026 08:12:25 -0800 (PST) X-Received: by 2002:a05:600c:8b6a:b0:4a1:f720:74cd with SMTP id 5b1f17b1804b1-4ac18c73d01mr234608685e9.24.1793635944632; Mon, 02 Nov 2026 08:12:24 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793635944; cv=none; d=google.com; s=arc-20260327; b=F8ucrcW5lW1hoeuv/elrMr+Vyu0YJD/KvzEtQbw0cFO5oY4u0I0ppOXUYA/earBKlR ffmhwVhD+X1GgcTx4t7dD+mU1RyCdK2viMu6HGTY/QAwm4sc+ABw9YUSZmRqmujCvhl+ +w5pLF2QVQUvQmNSkNd/h0cKFXo+ZY+af8VtxdTNyWQZpCbJ7XBzOdUQOwT3ZUC/Xg8p DBQ4YlGlrDUPaXxsQgMcp1frf4WSGLSocdkqh+mHC9iNHSbWK+a70anSE+w6BMqA9YMT o2cXQyzSJMszIsTlBVtEqxXzVAylURLkLmmP/Vw2N614R2bi0i1ckVYbUyEkNIrA8bO/ 2hOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=LQKWq4b0LsA3I9H7hXn5Yc+Sn3l5iGUIPgweU3a6KqM=; fh=u+zJKzCEZqOUSDMso6VHPc0cb9ITP/M8as0BKUCqshg=; b=AXdm8pF8x8Kz8cZ7DORrsfQsuqSCeEyuYQS8YFIgHlfUaOM1VidteNe5FjSopifOwn /u15FN0oTHw2G+UfSrCUxncorXtnqD6tEigOF6yfifvPLRShTHbolLPSiGb/k6i9kgtj nD1yQC0UAIHseoRtZyKDBivDf1bKQt0utR/X8YsqmhaZLGXVqO4my4huizTyKv//9Prr dyhFk/pN77n31P5B+a9FvQqLsbg4ZoSW3dCxhog6jrv1+Ucyd9cZh3zQdUGj3OmFe4bQ YUaIv7d5v2DKeRS8sU1ocXicyo1vJtHwCFyVAh7rrSTbgYNasDZXf3O32O0EFJgvCyiN fPOw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@openvz.org header.s=google header.b=I7EWHYRO; spf=softfail (google.com: domain of transitioning den@openvz.org does not designate 2a06:5b06:b600:300:91db:48d7:7451:652a as permitted sender) smtp.mailfrom=den@openvz.org; dara=neutral header.i=@openvz.org Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id ffacd0b85a97d-48e6eb24189sor2412675f8f.1.2026.11.02.08.12.24 for (Google Transport Security); Mon, 02 Nov 2026 08:12:24 -0800 (PST) Received-SPF: softfail (google.com: domain of transitioning den@openvz.org does not designate 2a06:5b06:b600:300:91db:48d7:7451:652a as permitted sender) client-ip=2a06:5b06:b600:300:91db:48d7:7451:652a; Authentication-Results: mx.google.com; dkim=pass header.i=@openvz.org header.s=google header.b=I7EWHYRO; spf=softfail (google.com: domain of transitioning den@openvz.org does not designate 2a06:5b06:b600:300:91db:48d7:7451:652a as permitted sender) smtp.mailfrom=den@openvz.org; dara=neutral header.i=@openvz.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1793635944; x=1794240744; darn=openvz.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=LQKWq4b0LsA3I9H7hXn5Yc+Sn3l5iGUIPgweU3a6KqM=; b=I7EWHYROplRV5NZTkwJwyahsxP4MALErJoN4WBQ/C4YtAstF495Yz6kMxSkUg50oEg 1MpAl8ATXK3LlNDwgmSDyS/+QcJG84AkcuUI7Y7YLAHWKMpHVw2x/uZorRAUREpdUnkS 33NNVKF2uszFDqzr3gBMVa1uHqqpuTc85ikwV9Bh6PFiX4xuR0F0Q8pC9hVMRY6cDFS0 TCyxKvXBA4J87f2oOyHDCBG77KZvJohUUoMxeYRDfTAUNOzdXcgZ9cG1FawP6lDQ7UoD yX89ONgNKx94Baw4jTyCujarQkiHnwZhhi/aj+I/SThVAlpegdaiuHVCfVVzS8gcBNBR 0DlQ== X-Forwarded-Encrypted: i=1; AKwUvBwpi/Vj/mOTm05PIKOzIoSX0JT3MRpwX+1FnPj+7t9U0Yh/A3FTEmwcvYnEbAvS4W1p+ct4Xw==@openvz.org X-Received: by 2002:a5d:588e:0:b0:48e:bf0:35c with SMTP id ffacd0b85a97d-48e6e4f543cmr21897670f8f.13.1793635944156; Mon, 02 Nov 2026 08:12:24 -0800 (PST) Received: from athena.sw.ru ([2a06:5b06:b600:300:91db:48d7:7451:652a]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e71b9b54dsm20387623f8f.47.2026.11.02.08.12.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 08:12:23 -0800 (PST) From: "Denis V. Lunev" To: Date: Mon, 2 Nov 2026 17:12:16 +0100 Message-ID: <20261102161219.3735623-2-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261102161219.3735623-1-den@openvz.org> References: <20261102161219.3735623-1-den@openvz.org> MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 1/2] ms/blk-throttle: fix access race during throttle policy activation X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: Han Guangjiang On repeated cold boots we occasionally hit a NULL pointer crash in blk_should_throtl() when throttling is consulted before the throttle policy is fully enabled for the queue. Checking only q->td != NULL is insufficient during early initialization, so blkg_to_pd() for the throttle policy can still return NULL and blkg_to_tg() becomes NULL, which later gets dereferenced. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000156 ... pc : submit_bio_noacct+0x14c/0x4c8 lr : submit_bio_noacct+0x48/0x4c8 sp : ffff800087f0b690 x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0 x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60 x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002 x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500 x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a Call trace: submit_bio_noacct+0x14c/0x4c8 verity_map+0x178/0x2c8 __map_bio+0x228/0x250 dm_submit_bio+0x1c4/0x678 __submit_bio+0x170/0x230 submit_bio_noacct_nocheck+0x16c/0x388 submit_bio_noacct+0x16c/0x4c8 submit_bio+0xb4/0x210 f2fs_submit_read_bio+0x4c/0xf0 f2fs_mpage_readpages+0x3b0/0x5f0 f2fs_readahead+0x90/0xe8 Tighten blk_throtl_activated() to also require that the throttle policy bit is set on the queue: return q->td != NULL && test_bit(blkcg_policy_throtl.plid, q->blkcg_pols); This prevents blk_should_throtl() from accessing throttle group state until policy data has been attached to blkgs. Fixes: a3166c51702b ("blk-throttle: delay initialization until configuration") Co-developed-by: Liang Jie Signed-off-by: Liang Jie Signed-off-by: Han Guangjiang Reviewed-by: Yu Kuai Signed-off-by: Jens Axboe (cherry picked from commit bd9fd5be6bc0836820500f68fff144609fbd85a9) https://virtuozzo.atlassian.net/browse/VSTOR-152993 Feature: fix ms/block Signed-off-by: Denis V. Lunev --- block/blk-cgroup.c | 6 ------ block/blk-cgroup.h | 6 ++++++ block/blk-throttle.c | 6 +----- block/blk-throttle.h | 18 +++++++++++------- 4 files changed, 18 insertions(+), 18 deletions(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index e4ef47299609..39821d20ba07 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -110,12 +110,6 @@ static struct cgroup_subsys_state *blkcg_css(void) return task_css(current, io_cgrp_id); } -static bool blkcg_policy_enabled(struct request_queue *q, - const struct blkcg_policy *pol) -{ - return pol && test_bit(pol->plid, q->blkcg_pols); -} - static void blkg_free_workfn(struct work_struct *work) { struct blkcg_gq *blkg = container_of(work, struct blkcg_gq, diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h index 81868ad86330..83367086cb6a 100644 --- a/block/blk-cgroup.h +++ b/block/blk-cgroup.h @@ -459,6 +459,12 @@ static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) bio_issue_as_root_blkg(rq->bio) == bio_issue_as_root_blkg(bio); } +static inline bool blkcg_policy_enabled(struct request_queue *q, + const struct blkcg_policy *pol) +{ + return pol && test_bit(pol->plid, q->blkcg_pols); +} + void blk_cgroup_bio_start(struct bio *bio); void blkcg_add_delay(struct blkcg_gq *blkg, u64 now, u64 delta); #else /* CONFIG_BLK_CGROUP */ diff --git a/block/blk-throttle.c b/block/blk-throttle.c index 397b6a410f9e..cfa1cd60d2c5 100644 --- a/block/blk-throttle.c +++ b/block/blk-throttle.c @@ -1327,17 +1327,13 @@ static int blk_throtl_init(struct gendisk *disk) INIT_WORK(&td->dispatch_work, blk_throtl_dispatch_work_fn); throtl_service_queue_init(&td->service_queue); - /* - * Freeze queue before activating policy, to synchronize with IO path, - * which is protected by 'q_usage_counter'. - */ memflags = blk_mq_freeze_queue(disk->queue); blk_mq_quiesce_queue(disk->queue); q->td = td; td->queue = q; - /* activate policy */ + /* activate policy, blk_throtl_activated() will return true */ ret = blkcg_activate_policy(disk, &blkcg_policy_throtl); if (ret) { q->td = NULL; diff --git a/block/blk-throttle.h b/block/blk-throttle.h index 3b27755bfbff..9d7a42c039a1 100644 --- a/block/blk-throttle.h +++ b/block/blk-throttle.h @@ -156,7 +156,13 @@ void blk_throtl_cancel_bios(struct gendisk *disk); static inline bool blk_throtl_activated(struct request_queue *q) { - return q->td != NULL; + /* + * q->td guarantees that the blk-throttle module is already loaded, + * and the plid of blk-throttle is assigned. + * blkcg_policy_enabled() guarantees that the policy is activated + * in the request_queue. + */ + return q->td != NULL && blkcg_policy_enabled(q, &blkcg_policy_throtl); } static inline bool blk_should_throtl(struct bio *bio) @@ -164,11 +170,6 @@ static inline bool blk_should_throtl(struct bio *bio) struct throtl_grp *tg; int rw = bio_data_dir(bio); - /* - * This is called under bio_queue_enter(), and it's synchronized with - * the activation of blk-throtl, which is protected by - * blk_mq_freeze_queue(). - */ if (!blk_throtl_activated(bio->bi_bdev->bd_queue)) return false; @@ -194,7 +195,10 @@ static inline bool blk_should_throtl(struct bio *bio) static inline bool blk_throtl_bio(struct bio *bio) { - + /* + * block throttling takes effect if the policy is activated + * in the bio's request_queue. + */ if (!blk_should_throtl(bio)) return false; -- 2.53.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel