Re: [PATCH v4 1/4] blk-cg roup: protect q->blkg_lis t iteration in blkg_destroy_all() with blkcg_mutex

=E4=BA=8E 2026=E5=B9=B48=E6=9C=882=E6=97=A5 GMT+08:00 19:25:17=EF=BC=8CYu =
Kuai <yukuai@kernel=2Eorg> =E5=86=99=E9=81=93=EF=BC=9A
>From: Yu Kuai <yukuai@fygo=2Eio>
>
>blkg_destroy_all() iterates q->blkg_list without holding blkcg_mutex,
>which can race with blkg_free_workfn() that removes blkgs from the list
>while holding blkcg_mutex=2E
>
>Add blkcg_mutex protection around the q->blkg_list iteration to prevent
>potential list corruption or use-after-free issues=2E
>
>Reviewed-by: Tang Yizhou <yizhou=2Etang@shopee=2Ecom>
>Signed-off-by: Yu Kuai <yukuai@fygo=2Eio>
>---
> block/blk-cgroup=2Ec | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/block/blk-cgroup=2Ec b/block/blk-cgroup=2Ec
>index d9676126c5b5=2E=2Eeb0cfb10b859 100644
>--- a/block/blk-cgroup=2Ec
>+++ b/block/blk-cgroup=2Ec
>@@ -569,6 +569,7 @@ static void blkg_destroy_all(struct gendisk *disk)
> 	int i;
>=20
> restart:
>+	mutex_lock(&q->blkcg_mutex);
> 	spin_lock_irq(&q->queue_lock);
> 	list_for_each_entry(blkg, &q->blkg_list, q_node) {
> 		struct blkcg *blkcg =3D blkg->blkcg;
>@@ -587,6 +588,7 @@ static void blkg_destroy_all(struct gendisk *disk)
> 		if (!(--count)) {
> 			count =3D BLKG_DESTROY_BATCH_SIZE;
> 			spin_unlock_irq(&q->queue_lock);
>+			mutex_unlock(&q->blkcg_mutex);
> 			cond_resched();
> 			goto restart;
> 		}
>@@ -606,6 +608,7 @@ static void blkg_destroy_all(struct gendisk *disk)
>=20
> 	q->root_blkg =3D NULL;
> 	spin_unlock_irq(&q->queue_lock);
>+	mutex_unlock(&q->blkcg_mutex);
>=20
> 	wake_up_var(&q->root_blkg);
> }
Reviewed-by: Tao Cui <cuitao@kylinos=2Ecn>