Please enable JavaScript.
Coggle requires JavaScript to display documents.
blk-mq tags vs scheduler switch - Coggle Diagram
blk-mq tags vs scheduler switch
background
scheduler
request is allocated from scheduler request pool
request is attached to driver tags's ->rqs[] after driver tag is assigned
rqs[tag] won't be cleared
so rq reference may stay in driver tags's rqs[] after scheduler is switch out
drivers tags walking
stable scheduler rq may be observed and touched
UAF is triggered
in-tree solution
clear driver tags ->rqs[] for any freed request
driver tags lock is required when walking driver tags
cause performance issue and lockup
how to solve the performance issue
walking tags is needed for reading part/inflight
walking tags is needed in handling scsi host blocked
lockup
update_io_ticks() won't walk tags
same problem exits on hctx->fq->flush_rq
problem summery
driver tags is host wide and shared by all LUNs
walking tags may not sleep
so rcu sync can't be used
other LUNs are still working when switching one LUN's scheduler
driver tag allocation and assign rq to rqs[] are not done atomically
small window to read stale request reference
after allocating tag and before assigning request to rqs[]
is it possible to avoid to assign request to rqs[]?
how to walk over host wide tags?
why can't always walk over request queue tags?
none
doesn't have per-queue tags
solution
hold srcu when walking driver tags
use call_sruc() to free requests & flush_rq