block: fail to show/store elevator sysfs attribute if elevator is dying

JIRA: https://issues.redhat.com/browse/RHEL-112997

commit 5c3d858
Author: Ming Lei <[email protected]>
Date:   Mon May 5 22:17:57 2025 +0800

    block: fail to show/store elevator sysfs attribute if elevator is dying

    Prepare for moving elv_register[unregister]_queue out of elevator_lock
    & queue freezing, so we may have to call elv_unregister_queue() after
    elevator ->exit() is called, then there is small window for user to
    call into ->show()/store(), and user-after-free can be caused.

    Fail to show/store elevator sysfs attribute if elevator is dying by
    adding one new flag of ELEVATOR_FLAG_DYNG, which is protected by
    elevator ->sysfs_lock.

    Reviewed-by: Christoph Hellwig <[email protected]>
    Reviewed-by: Nilay Shroff <[email protected]>
    Signed-off-by: Ming Lei <[email protected]>
    Reviewed-by: Hannes Reinecke <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jens Axboe <[email protected]>

Signed-off-by: Ming Lei <[email protected]>

Author: Ming Lei

block/blk-mq-sched.c

@@ -551,5 +551,6 @@ void blk_mq_exit_sched(struct request_queue *q, struct elevator_queue *e)
 	if (e->type->ops.exit_sched)
 		e->type->ops.exit_sched(e);
 	blk_mq_sched_tags_teardown(q, flags);
+	set_bit(ELEVATOR_FLAG_DYING, &q->elevator->flags);
 	q->elevator = NULL;
 }

block/elevator.c

@@ -418,14 +418,15 @@ elv_attr_show(struct kobject *kobj, struct attribute *attr, char *page)
 {
 	const struct elv_fs_entry *entry = to_elv(attr);
 	struct elevator_queue *e;
-	ssize_t error;
+	ssize_t error = -ENODEV;
 
 	if (!entry->show)
 		return -EIO;
 
 	e = container_of(kobj, struct elevator_queue, kobj);
 	mutex_lock(&e->sysfs_lock);
-	error = entry->show(e, page);
+	if (!test_bit(ELEVATOR_FLAG_DYING, &e->flags))
+		error = entry->show(e, page);
 	mutex_unlock(&e->sysfs_lock);
 	return error;
 }
@@ -436,14 +437,15 @@ elv_attr_store(struct kobject *kobj, struct attribute *attr,
 {
 	const struct elv_fs_entry *entry = to_elv(attr);
 	struct elevator_queue *e;
-	ssize_t error;
+	ssize_t error = -ENODEV;
 
 	if (!entry->store)
 		return -EIO;
 
 	e = container_of(kobj, struct elevator_queue, kobj);
 	mutex_lock(&e->sysfs_lock);
-	error = entry->store(e, page, length);
+	if (!test_bit(ELEVATOR_FLAG_DYING, &e->flags))
+		error = entry->store(e, page, length);
 	mutex_unlock(&e->sysfs_lock);
 	return error;
 }

block/elevator.h

@@ -132,6 +132,7 @@ struct elevator_queue
 };
 
 #define ELEVATOR_FLAG_REGISTERED	0
+#define ELEVATOR_FLAG_DYING		1
 
 /*
  * block elevator interface