Skip to content

Commit

Permalink
ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd
Browse files Browse the repository at this point in the history
ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but
we may have scheduled task work via io_uring_cmd_complete_in_task() for
dispatching request, then kernel crash can be triggered.

Fix it by not trying to canceling the command if ublk block request is
started.

Fixes: 216c8f5 ("ublk: replace monitor with cancelable uring_cmd")
Reported-by: Jared Holzman <jholzman@nvidia.com>
Tested-by: Jared Holzman <jholzman@nvidia.com>
Closes: https://lore.kernel.org/linux-block/d2179120-171b-47ba-b664-23242981ef19@nvidia.com/
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250425013742.1079549-3-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
  • Loading branch information
Ming Lei authored and Jens Axboe committed Apr 25, 2025
1 parent d6aa0c1 commit f40139f
Showing 1 changed file with 21 additions and 6 deletions.
27 changes: 21 additions & 6 deletions drivers/block/ublk_drv.c
Original file line number Diff line number Diff line change
Expand Up @@ -1683,14 +1683,31 @@ static void ublk_start_cancel(struct ublk_queue *ubq)
ublk_put_disk(disk);
}

static void ublk_cancel_cmd(struct ublk_queue *ubq, struct ublk_io *io,
static void ublk_cancel_cmd(struct ublk_queue *ubq, unsigned tag,
unsigned int issue_flags)
{
struct ublk_io *io = &ubq->ios[tag];
struct ublk_device *ub = ubq->dev;
struct request *req;
bool done;

if (!(io->flags & UBLK_IO_FLAG_ACTIVE))
return;

/*
* Don't try to cancel this command if the request is started for
* avoiding race between io_uring_cmd_done() and
* io_uring_cmd_complete_in_task().
*
* Either the started request will be aborted via __ublk_abort_rq(),
* then this uring_cmd is canceled next time, or it will be done in
* task work function ublk_dispatch_req() because io_uring guarantees
* that ublk_dispatch_req() is always called
*/
req = blk_mq_tag_to_rq(ub->tag_set.tags[ubq->q_id], tag);
if (req && blk_mq_request_started(req))
return;

spin_lock(&ubq->cancel_lock);
done = !!(io->flags & UBLK_IO_FLAG_CANCELED);
if (!done)
Expand Down Expand Up @@ -1722,7 +1739,6 @@ static void ublk_uring_cmd_cancel_fn(struct io_uring_cmd *cmd,
struct ublk_uring_cmd_pdu *pdu = ublk_get_uring_cmd_pdu(cmd);
struct ublk_queue *ubq = pdu->ubq;
struct task_struct *task;
struct ublk_io *io;

if (WARN_ON_ONCE(!ubq))
return;
Expand All @@ -1737,9 +1753,8 @@ static void ublk_uring_cmd_cancel_fn(struct io_uring_cmd *cmd,
if (!ubq->canceling)
ublk_start_cancel(ubq);

io = &ubq->ios[pdu->tag];
WARN_ON_ONCE(io->cmd != cmd);
ublk_cancel_cmd(ubq, io, issue_flags);
WARN_ON_ONCE(ubq->ios[pdu->tag].cmd != cmd);
ublk_cancel_cmd(ubq, pdu->tag, issue_flags);
}

static inline bool ublk_queue_ready(struct ublk_queue *ubq)
Expand All @@ -1752,7 +1767,7 @@ static void ublk_cancel_queue(struct ublk_queue *ubq)
int i;

for (i = 0; i < ubq->q_depth; i++)
ublk_cancel_cmd(ubq, &ubq->ios[i], IO_URING_F_UNLOCKED);
ublk_cancel_cmd(ubq, i, IO_URING_F_UNLOCKED);
}

/* Cancel all pending commands, must be called after del_gendisk() returns */
Expand Down

0 comments on commit f40139f

Please sign in to comment.