From nobody Sat Jul 25 20:10:53 2026 Received: from dggsgout12.his.huawei.com (dggsgout12.his.huawei.com [45.249.212.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 363372D1911; Tue, 14 Jul 2026 04:26:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003180; cv=none; b=thT/FkZ0W4Rj1C713/BFcGtXNz+hUodeTqDT2h5B/SuJLDD9NPm3JxXBuyrzhX0ZoXXa6p+a81zNxXA5azNE+T/B/zToe/NuCJ0O2ExmObDw5xVbkc1Om1CeLA6NWvIN7D9E7PF/LAcZwZp6mlPqLv9ESJdyJCwn9xgAbfXXZic= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003180; c=relaxed/simple; bh=Lw+8i5bljnExYELPOEf4WhkLj+elq+pvzroM7rLWSbE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KBqoCjCjlZoDflpc400DJtYvFRbI0RnQG2BL9JhFws9KEs9cYEtzrRFPLUi7UrDfmUDZDdJ8UuNNnWtvLbOkTeTBSuMMt9z9I1HcGnrhYZmiXXyon0k0HNvxryb21liSxDSbiRmD9jC2M0hI5M7KjYobYGXlLeyiwziZ8DVOiKQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=none smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.177]) by dggsgout12.his.huawei.com (SkyGuard) with ESMTPS id 4gzmSl4tB7zKHMLg; Tue, 14 Jul 2026 12:25:43 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.112]) by mail.maildlp.com (Postfix) with ESMTP id CA1894058C; Tue, 14 Jul 2026 12:26:13 +0800 (CST) Received: from huaweicloud.com (unknown [10.50.85.155]) by APP1 (Coremail) with UTF8SMTPSA id cCh0CgBHWHRkulVq2zKnBA--.54416S5; Tue, 14 Jul 2026 12:26:13 +0800 (CST) From: Zizhi Wo To: axboe@kernel.dk, dlemoal@kernel.org, nilay@linux.ibm.com, kch@nvidia.com, johannes.thumshirn@wdc.com, kbusch@kernel.org, bvanassche@acm.org, linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org, yangerkun@huawei.com, chengzhihao1@huawei.com, wozizhi@huawei.com Subject: [PATCH V5 1/9] null_blk: use DEFINE_MUTEX for the file-scope mutex Date: Tue, 14 Jul 2026 12:17:57 +0800 Message-ID: <20260714041805.1088702-2-wozizhi@huaweicloud.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260714041805.1088702-1-wozizhi@huaweicloud.com> References: <20260714041805.1088702-1-wozizhi@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: cCh0CgBHWHRkulVq2zKnBA--.54416S5 X-Coremail-Antispam: 1UD129KBjvJXoW7Aw4rAr18Kr4xtFyfGFy3urg_yoW5JF45pF WUWw1j9r10g3W7ZFZ8ta4xuFy5Aan2gFW8Gry7CF1F9FsxArn8ArnrCF4YgF45K3yxA3y3 XFn2vryxAayUArUanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUP2b4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUGw A2048vs2IY020Ec7CjxVAFwI0_Gr0_Xr1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0rcxS w2x7M28EF7xvwVC0I7IYx2IY67AKxVWUJVWUCwA2z4x0Y4vE2Ix0cI8IcVCY1x0267AKxV WxJVW8Jr1l84ACjcxK6I8E87Iv67AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVCY1x0267AK xVW0oVCq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ew Av7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY 6r1j6r4UM4x0Y48IcxkI7VAKI48JM4IIrI8v6xkF7I0E8cxan2IY04v7MxkF7I0En4kS14 v26r1q6r43MxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8C rVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUtVW8Zw CIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x02 67AKxVW8JVWxJwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr 0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZEXa7IU8-_ -PUUUUU== X-CM-SenderInfo: pzr2x6tkl6x35dzhxuhorxvhhfrp/ Content-Type: text/plain; charset="utf-8" From: Zizhi Wo In null_init(), mutex_init(&lock) currently happens after configfs_register_subsystem(), which exposes the nullb subsystem to userspace. A racing mkdir() into /sys/kernel/config/nullb/ can reach null_find_dev_by_name() -> mutex_lock(&lock) before the mutex is initialized, trigger warning: [ 123.137788] DEBUG_LOCKS_WARN_ON(lock->magic !=3D lock) [ 123.137796] WARNING: kernel/locking/mutex.c:159 at mutex_lock+0x171/0x1c= 0, CPU#13: mkdir/1301 [ 123.140090] Modules linked in: null_blk(+) nft_fib_inet nft_fib_ipv4 ...... [ 123.154926] Call Trace: [ 123.155172] [ 123.155419] ? __pfx_mutex_lock+0x10/0x10 [ 123.156181] ? __pfx__raw_spin_lock+0x10/0x10 [ 123.156571] nullb_group_make_group+0x20/0x100 [null_blk] [ 123.157011] configfs_mkdir+0x47b/0xc70 [ 123.157337] ? __pfx_configfs_mkdir+0x10/0x10 [ 123.157719] ? may_create_dentry+0x242/0x2e0 [ 123.158061] vfs_mkdir+0x2a9/0x6c0 [ 123.158352] filename_mkdirat+0x3dc/0x500 [ 123.158710] ? __pfx_filename_mkdirat+0x10/0x10 [ 123.159070] ? strncpy_from_user+0x3a/0x1d0 [ 123.159413] __x64_sys_mkdir+0x6b/0x90 [ 123.159760] do_syscall_64+0xea/0x600 Replace the runtime mutex_init(&lock) with a static DEFINE_MUTEX(lock) declaration to fix this issue. Fixes: 49c3b9266a71 ("block: null_blk: Improve device creation with configf= s") Suggested-by: Bart Van Assche Signed-off-by: Zizhi Wo Reviewed-by: Bart Van Assche Reviewed-by: Damien Le Moal Reviewed-by: Nilay Shroff --- drivers/block/null_blk/main.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index f8c0fd57e041..eba204b27785 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -66,7 +66,7 @@ struct nullb_page { #define NULLB_PAGE_FREE (MAP_SZ - 2) =20 static LIST_HEAD(nullb_list); -static struct mutex lock; +static DEFINE_MUTEX(lock); static int null_major; static DEFINE_IDA(nullb_indexes); static struct blk_mq_tag_set tag_set; @@ -2166,8 +2166,6 @@ static int __init null_init(void) if (ret) return ret; =20 - mutex_init(&lock); - null_major =3D register_blkdev(0, "nullb"); if (null_major < 0) { ret =3D null_major; --=20 2.52.0 From nobody Sat Jul 25 20:10:53 2026 Received: from dggsgout12.his.huawei.com (dggsgout12.his.huawei.com [45.249.212.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 363C62D2394; Tue, 14 Jul 2026 04:26:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003179; cv=none; b=IJca413YRq56F4ykFBAB7ABciaqbefompcD0mprxserkk9Q9JtkubUUgzwRtCX1GxDiI2MY+GA2vs30vd+aAM3NGTkK/JfxBnhRCBkX4GF6nih1yp5wyrZAtwXxsxmasyanq+oOPR3C4ULWXdeHg/M4qQ4t3WckTLBqqGP9neVo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003179; c=relaxed/simple; bh=R3I6gVd+APqzfeC+W+pgCe8DnbwqbUbl4E5EOcivFNk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WUr8GtsNPRv2Sx8Ja7/IdJ+ifsUi5jj8pQoPIfVfp0XOe31M5rbwQdRR9mdJQUC5WWrXh+TlEW9gKqSfMYWUNw4JALLHTmrTPLvh/suiyL6DRNvUrnTVqYtjJNUEtHNZCADZAHUDNwSlpD5K0Y0N28HqTH9s29NAPZNaJ2fLljo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.198]) by dggsgout12.his.huawei.com (SkyGuard) with ESMTPS id 4gzmSl5W01zKHMMD; Tue, 14 Jul 2026 12:25:43 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.112]) by mail.maildlp.com (Postfix) with ESMTP id E049C407DC; Tue, 14 Jul 2026 12:26:13 +0800 (CST) Received: from huaweicloud.com (unknown [10.50.85.155]) by APP1 (Coremail) with UTF8SMTPSA id cCh0CgBHWHRkulVq2zKnBA--.54416S6; Tue, 14 Jul 2026 12:26:13 +0800 (CST) From: Zizhi Wo To: axboe@kernel.dk, dlemoal@kernel.org, nilay@linux.ibm.com, kch@nvidia.com, johannes.thumshirn@wdc.com, kbusch@kernel.org, bvanassche@acm.org, linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org, yangerkun@huawei.com, chengzhihao1@huawei.com, wozizhi@huawei.com Subject: [PATCH V5 2/9] null_blk: register configfs subsystem after creating default devices Date: Tue, 14 Jul 2026 12:17:58 +0800 Message-ID: <20260714041805.1088702-3-wozizhi@huaweicloud.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260714041805.1088702-1-wozizhi@huaweicloud.com> References: <20260714041805.1088702-1-wozizhi@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: cCh0CgBHWHRkulVq2zKnBA--.54416S6 X-Coremail-Antispam: 1UD129KBjvJXoWxGrykGry8Ar17ur45ZFyrJFb_yoW5tFWfpF yUWw17Kry8tF1Uur4jva109FyfGan293yxu3yxCF1rZanxAry5AF9IvayrGF4UG3yxCF4f Xas0va1rGa48Cr7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUP2b4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUXw A2048vs2IY020Ec7CjxVAFwI0_Xr0E3s1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0rcxS w2x7M28EF7xvwVC0I7IYx2IY67AKxVWUCVW8JwA2z4x0Y4vE2Ix0cI8IcVCY1x0267AKxV WxJVW8Jr1l84ACjcxK6I8E87Iv67AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVCY1x0267AK xVW0oVCq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ew Av7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY 6r1j6r4UM4x0Y48IcxkI7VAKI48JM4IIrI8v6xkF7I0E8cxan2IY04v7MxkF7I0En4kS14 v26r1q6r43MxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8C rVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUtVW8Zw CIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x02 67AKxVW8JVWxJwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr 0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZEXa7IU1VT 5JUUUUU== X-CM-SenderInfo: pzr2x6tkl6x35dzhxuhorxvhhfrp/ Content-Type: text/plain; charset="utf-8" From: Zizhi Wo In null_init(), configfs_register_subsystem() currently runs before register_blkdev(), so when null_blk is built as a module, a racing mkdir() + poweron from userspace can reach null_add_dev() while null_major is still 0. __add_disk() then hits WARN_ON(disk->minors) (major=3D0 with minors!=3D0) and fails: [root@fedora ~]# [ 2366.521436] WARNING: block/genhd.c:476 at __add_disk+0x= 8a7/0xde0, [ 2366.523552] Modules linked in: null_blk(+) nft_fib_inet nft_fib_ipv4 nft= _fib_ipv6 nft_fib [ 2366.529081] CPU: 26 UID: 0 PID: 1600 Comm: sh Not tainted 7.2.0-rc1+ #66= PREEMPT(full) ...... [ 2366.547251] Call Trace: [ 2366.547575] [ 2366.547831] ? _raw_spin_lock+0x84/0xe0 [ 2366.548260] add_disk_fwnode+0x114/0x560 [ 2366.548739] null_add_dev+0x102d/0x1b80 [null_blk] [ 2366.549310] ? __pfx_null_add_dev+0x10/0x10 [null_blk] [ 2366.549906] ? mutex_lock+0xde/0x1c0 [ 2366.550361] ? __pfx_mutex_lock+0x10/0x10 [ 2366.550827] nullb_device_power_store+0x1e7/0x280 [null_blk] [ 2366.551499] ? __pfx_nullb_device_power_store+0x10/0x10 [null_blk] [ 2366.552177] ? __kmalloc_cache_noprof+0x1f5/0x470 [ 2366.552748] ? configfs_write_iter+0x35c/0x4e0 [ 2366.553242] configfs_write_iter+0x286/0x4e0 [ 2366.553787] vfs_write+0x52d/0xd00 [ 2366.554169] ? __pfx_vfs_write+0x10/0x10 [ 2366.554679] ? __pfx___css_rstat_updated+0x10/0x10 [ 2366.555196] ? fdget_pos+0x1cf/0x4c0 [ 2366.555649] ksys_write+0xfc/0x1d0 ...... Additionally, the err_dev path destroys all devices on nullb_list while configfs is still registered. If a racing mkdir() + poweron puts a user device on the list, null_destroy_dev()->null_free_dev() kfrees the user device's nullb_device but /sys/kernel/config/nullb/ is still reachable. Any userspace access to the item will trigger a UAF. For simplicity, move configfs_register_subsystem() to the end to solve the problems above. Fixes: 3bf2bd20734e ("nullb: add configfs interface") Signed-off-by: Zizhi Wo Reviewed-by: Damien Le Moal Reviewed-by: Bart Van Assche Reviewed-by: Nilay Shroff --- drivers/block/null_blk/main.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index eba204b27785..4613035222cd 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -2162,15 +2162,9 @@ static int __init null_init(void) config_group_init(&nullb_subsys.su_group); mutex_init(&nullb_subsys.su_mutex); =20 - ret =3D configfs_register_subsystem(&nullb_subsys); - if (ret) - return ret; - null_major =3D register_blkdev(0, "nullb"); - if (null_major < 0) { - ret =3D null_major; - goto err_conf; - } + if (null_major < 0) + return null_major; =20 for (i =3D 0; i < nr_devices; i++) { ret =3D null_create_dev(); @@ -2178,6 +2172,10 @@ static int __init null_init(void) goto err_dev; } =20 + ret =3D configfs_register_subsystem(&nullb_subsys); + if (ret) + goto err_dev; + pr_info("module loaded\n"); return 0; =20 @@ -2187,8 +2185,6 @@ static int __init null_init(void) null_destroy_dev(nullb); } unregister_blkdev(null_major, "nullb"); -err_conf: - configfs_unregister_subsystem(&nullb_subsys); return ret; } =20 --=20 2.52.0 From nobody Sat Jul 25 20:10:53 2026 Received: from dggsgout11.his.huawei.com (dggsgout11.his.huawei.com [45.249.212.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 580A22D63F8; Tue, 14 Jul 2026 04:26:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003180; cv=none; b=iFbWdZVHH39YtS40pL/8gFag8GNOLR0H3Ed1RjrA7F3i5Zr1xEIVBNztNscILmFDlcyuTQ6pCH3A4NAZtVT38s0qVKsahG0rF3U1uiy8hbW12OtMDG9SBHba7X4lSudcnd4nrs+letOuJv+SO8QwkWa8W0jt78nw/0rsOYHY7b0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003180; c=relaxed/simple; bh=7jDL0oIxqBlTqI7qrQ0kTFI0Bd3+Z1QaSd0iisfOBz4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tCDryItX/tK4Y0owhZy8LFA9MujQICDW4qwMmdisx4UTFsyDsfV4ARewQQ8HP6xGmqQSrZn+/pXiGanumLPeUzwpy5HvqKQ3PAYeIcvdW3/3V/WOLE5tOSLmmDgTBS4NXDGlpqhxknhUPdU0qKZHr6s+Y1QLEF5jlRf9M7wY7ts= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.177]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTPS id 4gzmT31pRKzYQtjc; Tue, 14 Jul 2026 12:25:59 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.112]) by mail.maildlp.com (Postfix) with ESMTP id F07674058F; Tue, 14 Jul 2026 12:26:13 +0800 (CST) Received: from huaweicloud.com (unknown [10.50.85.155]) by APP1 (Coremail) with UTF8SMTPSA id cCh0CgBHWHRkulVq2zKnBA--.54416S7; Tue, 14 Jul 2026 12:26:13 +0800 (CST) From: Zizhi Wo To: axboe@kernel.dk, dlemoal@kernel.org, nilay@linux.ibm.com, kch@nvidia.com, johannes.thumshirn@wdc.com, kbusch@kernel.org, bvanassche@acm.org, linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org, yangerkun@huawei.com, chengzhihao1@huawei.com, wozizhi@huawei.com Subject: [PATCH V5 3/9] null_blk: move unregister_blkdev() after destroying dev in null_exit() Date: Tue, 14 Jul 2026 12:17:59 +0800 Message-ID: <20260714041805.1088702-4-wozizhi@huaweicloud.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260714041805.1088702-1-wozizhi@huaweicloud.com> References: <20260714041805.1088702-1-wozizhi@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: cCh0CgBHWHRkulVq2zKnBA--.54416S7 X-Coremail-Antispam: 1UD129KBjvJXoW7Zw47ZF4xKFWrurW8Jr4UCFg_yoW8GF1DpF 45W3Wjkr10kF1UZF4UC3WxAFy5Gan7GrWI9rWUCa4Fv398Zry29wnrta4rXF1Dt3yxCF4S vF1vva4SqayDArDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUPIb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUWw A2048vs2IY020Ec7CjxVAFwI0_Xr0E3s1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0rcxS w2x7M28EF7xvwVC0I7IYx2IY67AKxVWUCVW8JwA2z4x0Y4vE2Ix0cI8IcVCY1x0267AKxV W8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIEc7CjxVAF wI0_GcCE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2 WlYx0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkE bVWUJVW8JwACjcxG0xvY0x0EwIxGrwACI402YVCY1x02628vn2kIc2xKxwCY1x0262kKe7 AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02 F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GF ylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7Cj xVAFwI0_Gr0_Cr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r 1j6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x07UA CztUUUUU= X-CM-SenderInfo: pzr2x6tkl6x35dzhxuhorxvhhfrp/ Content-Type: text/plain; charset="utf-8" From: Zizhi Wo In null_exit(), unregister_blkdev() is called before the null_blk instances are destroyed, which is inconsistent with the cleanup order in null_init(). Move it after null_destroy_dev() so that teardown happens in the reverse order of initialization. No functional change intended. Suggested-by: Bart Van Assche Signed-off-by: Zizhi Wo Reviewed-by: Damien Le Moal Reviewed-by: Bart Van Assche Reviewed-by: Nilay Shroff --- drivers/block/null_blk/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index 4613035222cd..6cb213779cc5 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -2194,8 +2194,6 @@ static void __exit null_exit(void) =20 configfs_unregister_subsystem(&nullb_subsys); =20 - unregister_blkdev(null_major, "nullb"); - mutex_lock(&lock); while (!list_empty(&nullb_list)) { nullb =3D list_entry(nullb_list.next, struct nullb, list); @@ -2203,6 +2201,8 @@ static void __exit null_exit(void) } mutex_unlock(&lock); =20 + unregister_blkdev(null_major, "nullb"); + if (tag_set.ops) blk_mq_free_tag_set(&tag_set); =20 --=20 2.52.0 From nobody Sat Jul 25 20:10:53 2026 Received: from dggsgout11.his.huawei.com (dggsgout11.his.huawei.com [45.249.212.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 596CF2D6E5A; Tue, 14 Jul 2026 04:26:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003179; cv=none; b=Xj5ykSMKRejVADmnoa+wthvrTIoqiNtR/3of4F8erhSVuWz/T4uscbHBcj61HdsD51hFIBIudXpslYCcF6MEGE0AJCLdfxLI8V20IZhsWGce8gpsPCG7KXfEGqZb2C6/rcbRg1QN+7XEkI2bBs6RNjzqy/8qbEro730PMPErAM0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003179; c=relaxed/simple; bh=wAN8X6yhzhh8xIKRIXyntpv/tc89ZOLz8xL1tqy3G28=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pL1DfQSMa8hjffCx+u9Mt9ICDqrAjwSq97ckj4Z0rbLiDaSpsU5hN8TEUwYj1AmmrMiZiF3LvwdmuVwIZyLWapL2z6TZ92WAgoh87cNY2L7vYgTUh9UuX5Vj5EvamDfUBMeojyFsdx99kdm68mvNDSTsI0thqFnV1bcWaI8L8Ws= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.198]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTPS id 4gzmT32GswzYQtk6; Tue, 14 Jul 2026 12:25:59 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.112]) by mail.maildlp.com (Postfix) with ESMTP id 0B76D40965; Tue, 14 Jul 2026 12:26:14 +0800 (CST) Received: from huaweicloud.com (unknown [10.50.85.155]) by APP1 (Coremail) with UTF8SMTPSA id cCh0CgBHWHRkulVq2zKnBA--.54416S8; Tue, 14 Jul 2026 12:26:13 +0800 (CST) From: Zizhi Wo To: axboe@kernel.dk, dlemoal@kernel.org, nilay@linux.ibm.com, kch@nvidia.com, johannes.thumshirn@wdc.com, kbusch@kernel.org, bvanassche@acm.org, linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org, yangerkun@huawei.com, chengzhihao1@huawei.com, wozizhi@huawei.com Subject: [PATCH V5 4/9] null_blk: free global tag_set on init error path Date: Tue, 14 Jul 2026 12:18:00 +0800 Message-ID: <20260714041805.1088702-5-wozizhi@huaweicloud.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260714041805.1088702-1-wozizhi@huaweicloud.com> References: <20260714041805.1088702-1-wozizhi@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: cCh0CgBHWHRkulVq2zKnBA--.54416S8 X-Coremail-Antispam: 1UD129KBjvJXoW7tF4UGFyUWw1xAFy7Cry7trb_yoW8Jw4rpF 4UW3WUKry0kF17uFWjy3W2kFyrWan7JryUKrWak34F9r45Ar9Ikrn7tas8XF1UX393JFZa vFnrZFyrXayUGrDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUPvb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUAV Cq3wA2048vs2IY020Ec7CjxVAFwI0_Xr0E3s1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0 rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVWUCVW8JwA2z4x0Y4vE2Ix0cI8IcVCY1x0267 AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIEc7Cj xVAFwI0_GcCE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrV C2j2WlYx0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE 7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwACI402YVCY1x02628vn2kIc2xKxwCY1x0262 kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s02 6c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw 0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvE c7CjxVAFwI0_Cr0_Gr1UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67 AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuY vjxUF9NVUUUUU X-CM-SenderInfo: pzr2x6tkl6x35dzhxuhorxvhhfrp/ Content-Type: text/plain; charset="utf-8" From: Zizhi Wo If shared_tags is enabled, null_setup_tagset() allocates the global tag_set via null_init_global_tag_set(). If device creation later fails, err_dev destroys the default devices and calls unregister_blkdev(), but never frees the global tag_set. Since module init failed, null_exit() is never invoked, so the global tag_set's tags and maps are permanently leaked. Free the global tag_set in err_dev, matching null_exit() which does if (tag_set.ops) blk_mq_free_tag_set(&tag_set). Fixes: 82f402fefa50 ("null_blk: add support for shared tags") Signed-off-by: Zizhi Wo Reviewed-by: Damien Le Moal Reviewed-by: Bart Van Assche Reviewed-by: Nilay Shroff --- drivers/block/null_blk/main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index 6cb213779cc5..df85189f0b69 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -2185,6 +2185,8 @@ static int __init null_init(void) null_destroy_dev(nullb); } unregister_blkdev(null_major, "nullb"); + if (tag_set.ops) + blk_mq_free_tag_set(&tag_set); return ret; } =20 --=20 2.52.0 From nobody Sat Jul 25 20:10:53 2026 Received: from dggsgout11.his.huawei.com (dggsgout11.his.huawei.com [45.249.212.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 61FE22D7DD7; Tue, 14 Jul 2026 04:26:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003179; cv=none; b=B52QcXQBt2TB2OYWMnitdd9sMOR4WejHpQb1F2jG7RPgtOxixLgWZYOd5pbELWQ84sVGlZm6NMLyrdZkFNJJL/8GgvGgoKhbIHf29eXsmEAOpToMUw1Ky+zt52sEZNZLby+LbCoeIA/caO0KHpjAFB9XlOSOzsaR+p9FAhcLBqM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003179; c=relaxed/simple; bh=iciori9I+Uo+Ch/qT8BCLYPKlfBxEliOxgX/56dF+Ho=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BvRXJd6z0IkliRyDb/0jqRYofwl3iWL7bOY4dmo7rT20TfBZyM+54IWANayXOjH5Yb2cLy2MS3fAZK7m4ZIPU1ho3ryxOxdwVEPUIypRmFHMc7jxtuj2EsJC8kWsh5kMk1hJlOmXr1V5U3RR9HZ0xLmusT/T4XwbDz2NpTjg+C8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.198]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTPS id 4gzmT32gvPzYQtht; Tue, 14 Jul 2026 12:25:59 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.112]) by mail.maildlp.com (Postfix) with ESMTP id 19D68408CE; Tue, 14 Jul 2026 12:26:14 +0800 (CST) Received: from huaweicloud.com (unknown [10.50.85.155]) by APP1 (Coremail) with UTF8SMTPSA id cCh0CgBHWHRkulVq2zKnBA--.54416S9; Tue, 14 Jul 2026 12:26:13 +0800 (CST) From: Zizhi Wo To: axboe@kernel.dk, dlemoal@kernel.org, nilay@linux.ibm.com, kch@nvidia.com, johannes.thumshirn@wdc.com, kbusch@kernel.org, bvanassche@acm.org, linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org, yangerkun@huawei.com, chengzhihao1@huawei.com, wozizhi@huawei.com Subject: [PATCH V5 5/9] null_blk: free zones array on device power-off Date: Tue, 14 Jul 2026 12:18:01 +0800 Message-ID: <20260714041805.1088702-6-wozizhi@huaweicloud.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260714041805.1088702-1-wozizhi@huaweicloud.com> References: <20260714041805.1088702-1-wozizhi@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: cCh0CgBHWHRkulVq2zKnBA--.54416S9 X-Coremail-Antispam: 1UD129KBjvJXoWxGrWrZF15Ar18GryxJryUGFg_yoW5CrW8pF 4jga4Ygry0gr13ZFWDZr4DWF15uw4vyayxCry8Ja4S9rW3Ar9IyrWDAFy5Z3WDJ397ArWf XFZ5WFyfCa17JaUanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUPvb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUAV Cq3wA2048vs2IY020Ec7CjxVAFwI0_Xr0E3s1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0 rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVWUCVW8JwA2z4x0Y4vE2Ix0cI8IcVCY1x0267 AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIEc7Cj xVAFwI0_GcCE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrV C2j2WlYx0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE 7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwACI402YVCY1x02628vn2kIc2xKxwCY1x0262 kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s02 6c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw 0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUCVW8JwCI42IY6xIIjxv20xvE c7CjxVAFwI0_Cr0_Gr1UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67 AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuY vjxUF9NVUUUUU X-CM-SenderInfo: pzr2x6tkl6x35dzhxuhorxvhhfrp/ Content-Type: text/plain; charset="utf-8" From: Zizhi Wo null_init_zoned_dev() allocates dev->zones when a zoned device is powered on, but null_del_dev() never frees it on power-off; dev->zones is only freed later in null_free_dev(), when the configfs directory is removed. If the device is powered off and then on again, null_init_zoned_dev() allocates a new array and overwrites the dev->zones pointer, leaking the previous allocation each power cycle. Free dev->zones in null_del_dev() via null_free_zoned_dev() to solve it. And calling null_free_zoned_dev() in null_free_dev() is no longer necessary because every caller already invokes null_del_dev() first: via nullb_group_drop_item() before nullb_device_release(), in the null_add_dev() error path of null_create_dev(), and in null_destroy_dev(). Remove the redundant call. And take &lock around zone_cond_store() in the two store wrappers to serialize dev->zones check-and-deref against its alloc/free, which already run under &lock. The reason there was no problem before is that only nullb_device_release() or null_exit() frees the dev->zones, which guarantees that subsequent users won't access the configfs interface. Fixes: ca4b2a011948 ("null_blk: add zone support") Assisted-by: Claude-Code:GLM-5.2 Signed-off-by: Zizhi Wo Reviewed-by: Bart Van Assche Reviewed-by: Nilay Shroff --- drivers/block/null_blk/main.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index df85189f0b69..e063c931dfca 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -579,8 +579,13 @@ static ssize_t nullb_device_zone_readonly_store(struct= config_item *item, const char *page, size_t count) { struct nullb_device *dev =3D to_nullb_device(item); + ssize_t ret; + + mutex_lock(&lock); + ret =3D zone_cond_store(dev, page, count, BLK_ZONE_COND_READONLY); + mutex_unlock(&lock); =20 - return zone_cond_store(dev, page, count, BLK_ZONE_COND_READONLY); + return ret; } CONFIGFS_ATTR_WO(nullb_device_, zone_readonly); =20 @@ -588,8 +593,13 @@ static ssize_t nullb_device_zone_offline_store(struct = config_item *item, const char *page, size_t count) { struct nullb_device *dev =3D to_nullb_device(item); + ssize_t ret; =20 - return zone_cond_store(dev, page, count, BLK_ZONE_COND_OFFLINE); + mutex_lock(&lock); + ret =3D zone_cond_store(dev, page, count, BLK_ZONE_COND_OFFLINE); + mutex_unlock(&lock); + + return ret; } CONFIGFS_ATTR_WO(nullb_device_, zone_offline); =20 @@ -836,7 +846,6 @@ static void null_free_dev(struct nullb_device *dev) if (!dev) return; =20 - null_free_zoned_dev(dev); badblocks_exit(&dev->badblocks); kfree(dev); } @@ -1777,6 +1786,7 @@ static void null_del_dev(struct nullb *nullb) } =20 put_disk(nullb->disk); + null_free_zoned_dev(dev); if (nullb->tag_set =3D=3D &nullb->__tag_set) blk_mq_free_tag_set(nullb->tag_set); kfree(nullb->queues); --=20 2.52.0 From nobody Sat Jul 25 20:10:53 2026 Received: from dggsgout11.his.huawei.com (dggsgout11.his.huawei.com [45.249.212.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5535B2D5937; Tue, 14 Jul 2026 04:26:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003179; cv=none; b=SXgWQuPO4uBQnrxl1ge685ZJdqVrPDM7+zgk+I/Nw0mkdNh0SX9KF4tzKobaw2L7J+9axFxJRIe81CctM/Ufw7B3GNcIE96ELL2Fn4rmEUTNQXsct3bWkXnFXSets5XbS2WO7OxmIrE40qcD5SYcZfECw405wDZrYtx+xK58XlM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003179; c=relaxed/simple; bh=14sk9lk252YpBnggfKTx4JsZCMkURgvSmixBe0PG4oc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fbTnz4Bh8TpYLVEcVXDCTXHrcempfwReZFjJrx/0LCSxZR7xbnJo5SawCsmx365j1cOJHH8i7Y9lxpdCs/x8B2AwDnni0EBpGLAFzgP6UxX3MxmKyQEDSfShdlzKF6IyYrKsSYZoi6FRfGvy6Pwr8qJ1aLENYBP7e0yZQ1J3l40= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.177]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTPS id 4gzmT32swdzYQtkG; Tue, 14 Jul 2026 12:25:59 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.112]) by mail.maildlp.com (Postfix) with ESMTP id 2239140539; Tue, 14 Jul 2026 12:26:14 +0800 (CST) Received: from huaweicloud.com (unknown [10.50.85.155]) by APP1 (Coremail) with UTF8SMTPSA id cCh0CgBHWHRkulVq2zKnBA--.54416S10; Tue, 14 Jul 2026 12:26:13 +0800 (CST) From: Zizhi Wo To: axboe@kernel.dk, dlemoal@kernel.org, nilay@linux.ibm.com, kch@nvidia.com, johannes.thumshirn@wdc.com, kbusch@kernel.org, bvanassche@acm.org, linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org, yangerkun@huawei.com, chengzhihao1@huawei.com, wozizhi@huawei.com Subject: [PATCH V5 6/9] null_blk: clean up null_del_dev() to use cached dev pointer Date: Tue, 14 Jul 2026 12:18:02 +0800 Message-ID: <20260714041805.1088702-7-wozizhi@huaweicloud.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260714041805.1088702-1-wozizhi@huaweicloud.com> References: <20260714041805.1088702-1-wozizhi@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: cCh0CgBHWHRkulVq2zKnBA--.54416S10 X-Coremail-Antispam: 1UD129KBjvJXoW7GF18CFWUAFy8tw4fAr15twb_yoW8JF15pr WjgF1jkF48AF1UZF4DCws7XFy5Ja1Dt3y0grWjyasY9ryayry5Ar4qyFy5WF1UX397Ar4f ZFnxZFyxGay8J3JanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUPvb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUAV Cq3wA2048vs2IY020Ec7CjxVAFwI0_Xr0E3s1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0 rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVWUCVW8JwA2z4x0Y4vE2Ix0cI8IcVCY1x0267 AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIEc7Cj xVAFwI0_GcCE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrV C2j2WlYx0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE 7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwACI402YVCY1x02628vn2kIc2xKxwCY1x0262 kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s02 6c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw 0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUCVW8JwCI42IY6xIIjxv20xvE c7CjxVAFwI0_Cr0_Gr1UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67 AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuY vjxUF9NVUUUUU X-CM-SenderInfo: pzr2x6tkl6x35dzhxuhorxvhhfrp/ Content-Type: text/plain; charset="utf-8" From: Zizhi Wo Replace remaining nullb->dev dereferences with the already-cached local dev variable. No functional change. Signed-off-by: Zizhi Wo Reviewed-by: Nilay Shroff Reviewed-by: Bart Van Assche --- drivers/block/null_blk/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index e063c931dfca..249caaf6ce89 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -1779,7 +1779,7 @@ static void null_del_dev(struct nullb *nullb) =20 del_gendisk(nullb->disk); =20 - if (test_bit(NULLB_DEV_FL_THROTTLED, &nullb->dev->flags)) { + if (test_bit(NULLB_DEV_FL_THROTTLED, &dev->flags)) { hrtimer_cancel(&nullb->bw_timer); atomic_long_set(&nullb->cur_bytes, LONG_MAX); blk_mq_start_stopped_hw_queues(nullb->q, true); @@ -1791,7 +1791,7 @@ static void null_del_dev(struct nullb *nullb) blk_mq_free_tag_set(nullb->tag_set); kfree(nullb->queues); if (null_cache_active(nullb)) - null_free_device_storage(nullb->dev, true); + null_free_device_storage(dev, true); kfree(nullb); dev->nullb =3D NULL; } --=20 2.52.0 From nobody Sat Jul 25 20:10:53 2026 Received: from dggsgout12.his.huawei.com (dggsgout12.his.huawei.com [45.249.212.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 368502D2486; Tue, 14 Jul 2026 04:26:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003180; cv=none; b=jewHjCbaNORP2KKjgtFIRDEDnY0bRgUZuuMue81rtq7UuwcczNROXQITWOiX57TR/lQ6Y0uUd22loj8JHwhJdGuAPLNYoaLpx26DC6ipeBmOXlDRdnThceK9M48+9US3R8cCpEF0qTT+mKg7MnZrU6039SLCyeWgOp397QwY7zk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003180; c=relaxed/simple; bh=wxps8hTg+YscitVJedix/uB/417pItT4x+EkS+yf41Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Qj6+BwpEYtksnLNseD7fZwpEk8AMgKUvGDo2N18h2Aqg3TYQPUvxrR1B0iuUuXS8rSjPHrHa00XOAgmm9CEk4+tfQ+mp5LjGZRMSFAKr0tMJV17/5hzCxFtvc1bbjT7Dlq4MjDoe8oD47RGgLald/HQETiCM9Sb0FvsljxYbUjk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.170]) by dggsgout12.his.huawei.com (SkyGuard) with ESMTPS id 4gzmSm0mghzKHMMK; Tue, 14 Jul 2026 12:25:44 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.112]) by mail.maildlp.com (Postfix) with ESMTP id 3FBD54056B; Tue, 14 Jul 2026 12:26:14 +0800 (CST) Received: from huaweicloud.com (unknown [10.50.85.155]) by APP1 (Coremail) with UTF8SMTPSA id cCh0CgBHWHRkulVq2zKnBA--.54416S11; Tue, 14 Jul 2026 12:26:14 +0800 (CST) From: Zizhi Wo To: axboe@kernel.dk, dlemoal@kernel.org, nilay@linux.ibm.com, kch@nvidia.com, johannes.thumshirn@wdc.com, kbusch@kernel.org, bvanassche@acm.org, linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org, yangerkun@huawei.com, chengzhihao1@huawei.com, wozizhi@huawei.com Subject: [PATCH V5 7/9] null_blk: reject per-device queue resize for shared tag set Date: Tue, 14 Jul 2026 12:18:03 +0800 Message-ID: <20260714041805.1088702-8-wozizhi@huaweicloud.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260714041805.1088702-1-wozizhi@huaweicloud.com> References: <20260714041805.1088702-1-wozizhi@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: cCh0CgBHWHRkulVq2zKnBA--.54416S11 X-Coremail-Antispam: 1UD129KBjvJXoWxWF1xtF1xCryfAFW5AFyDAwb_yoW5tFyfpF WrKayFkr1kG3W8X3yj9w42gF43AF4kZFWfJryfJFy5u3ZFvr95Z34kAa1UWF48J3ykC3yS q3ZrZw4kKa4UJ3DanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUPvb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUAV Cq3wA2048vs2IY020Ec7CjxVAFwI0_Xr0E3s1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0 rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVW8JVW5JwA2z4x0Y4vE2Ix0cI8IcVCY1x0267 AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIEc7Cj xVAFwI0_GcCE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrV C2j2WlYx0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE 7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwACI402YVCY1x02628vn2kIc2xKxwCY1x0262 kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s02 6c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw 0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUCVW8JwCI42IY6xIIjxv20xvE c7CjxVAFwI0_Cr0_Gr1UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67 AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuY vjxUF9NVUUUUU X-CM-SenderInfo: pzr2x6tkl6x35dzhxuhorxvhhfrp/ Content-Type: text/plain; charset="utf-8" From: Zizhi Wo When shared_tags is enabled, null_setup_tagset() makes the device use the global tag_set, whose driver_data stays NULL. null_map_queues() therefore falls back to the module-wide g_submit_queues/g_poll_queues instead of any per-device value. Resizing submit_queues or poll_queues via configfs on such a device calls blk_mq_update_nr_hw_queues() on the shared set, shrinking set->nr_hw_queues. __blk_mq_realloc_hw_ctxs() only grows the q->queue_hw_ctx[] allocation, so on shrink it merely exits and NULLs the now-excess hctx slots. null_map_queues(), however, keeps mapping CPUs with the unchanged g_submit_queues/g_poll_queues, so mq_map[] ends up pointing at those NULLed hctx slots. blk_mq_map_swqueue() then dereferences the NULL hctx (hctx->cpumask), crashing the kernel: [ 460.218374] KASAN: null-ptr-deref in range [0x0000000000000098-0x0000000= 00000009f] [ 460.219003] CPU: 24 UID: 0 PID: 1492 Comm: sh Not tainted 7.2.0-rc2+ #67= PREEMPT(full) [ 460.219792] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS = 1.17.0-4.fc41 04/01/2014 [ 460.220452] RIP: 0010:blk_mq_map_swqueue+0x4db/0x1430 ...... [ 460.228977] Call Trace: [ 460.229175] [ 460.229354] blk_mq_update_nr_hw_queues+0xd49/0x11c0 [ 460.229779] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 460.230200] nullb_update_nr_hw_queues+0x1a9/0x370 [null_blk] [ 460.230694] nullb_device_submit_queues_store+0xd9/0x170 [null_blk] [ 460.231190] ? __pfx_nullb_device_submit_queues_store+0x10/0x10 [null_bl= k] [ 460.231776] ? configfs_write_iter+0x35c/0x4e0 [ 460.232122] configfs_write_iter+0x286/0x4e0 [ 460.232460] vfs_write+0x52d/0xd00 [ 460.232779] ? __x64_sys_openat+0x108/0x1d0 [ 460.233106] ? __pfx_vfs_write+0x10/0x10 [ 460.233413] ? fdget_pos+0x1cf/0x4c0 [ 460.233745] ? fput_close+0x133/0x190 [ 460.234038] ? __pfx_expand_files+0x10/0x10 [ 460.234368] ksys_write+0xfc/0x1d0 Reproducer: modprobe null_blk shared_tags=3D1 submit_queues=3D64 poll_queues=3D1 mkdir /sys/kernel/config/nullb/dev echo 1 > /sys/kernel/config/nullb/dev/power echo 1 > /sys/kernel/config/nullb/dev/submit_queues A per-device resize of a shared tag set is meaningless anyway, so reject it with -EINVAL in nullb_update_nr_hw_queues() when the device is bound to the global tag_set. Fixes: 45919fbfe1c4 ("null_blk: Enable modifying 'submit_queues' after an i= nstance has been configured") Suggested-by: Nilay Shroff Assisted-by: Claude-Code:GLM-5.2 Signed-off-by: Zizhi Wo Reviewed-by: Bart Van Assche Reviewed-by: Nilay Shroff --- drivers/block/null_blk/main.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index 249caaf6ce89..ad6dfed12464 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -382,6 +382,15 @@ static int nullb_update_nr_hw_queues(struct nullb_devi= ce *dev, if (!dev->nullb) return 0; =20 + /* + * A shared tag_set is mapped via the module-wide queue counts, so a + * per-device resize is meaningless. On shrink it would also leave + * mq_map[] pointing at NULLed hctx slots, causing a NULL deref in + * blk_mq_map_swqueue(). Reject it. + */ + if (dev->shared_tags) + return -EINVAL; + /* * Make sure at least one submit queue exists. */ --=20 2.52.0 From nobody Sat Jul 25 20:10:53 2026 Received: from dggsgout11.his.huawei.com (dggsgout11.his.huawei.com [45.249.212.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 314F330649C; Tue, 14 Jul 2026 04:26:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003184; cv=none; b=ai0Z0vyw7Z2OGB8Pxkb8qhFIPOky/SNsmC10icktRhNKoZhdhl1Ymd1y9v9yI53YpxBwQ8vcbh0pIeMxMnmiU1UKLNRhc7e1Ytfef5rj8juuVYsUbnfiT+5DilNJBe2b9JshSkC6jdF2jtRzZoBQuRN+gygTxmU3ZhHZyKuk4/A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003184; c=relaxed/simple; bh=4GYzKgGlAZUpwmiRm4WRsNJRIpVFNnLTlBDrCvbUmjU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QsZtmDYqbvkBp/ng50lI895xG3x9L6qAP2KugTANUpVHmMAZYP+V9Frw4KnnRvsdycYZmCA1yewGLvOOekwIVkLNQRWS6S34Ti5y1106lLXJQAdcX1GcVTPvs8tROvW6VuCAdHS26Kpk0sgRKd5Fjdx2Bk6eUO5+5cdWBoaK15g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.170]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTPS id 4gzmT34RDwzYQtk7; Tue, 14 Jul 2026 12:25:59 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.112]) by mail.maildlp.com (Postfix) with ESMTP id 59CC940570; Tue, 14 Jul 2026 12:26:14 +0800 (CST) Received: from huaweicloud.com (unknown [10.50.85.155]) by APP1 (Coremail) with UTF8SMTPSA id cCh0CgBHWHRkulVq2zKnBA--.54416S12; Tue, 14 Jul 2026 12:26:14 +0800 (CST) From: Zizhi Wo To: axboe@kernel.dk, dlemoal@kernel.org, nilay@linux.ibm.com, kch@nvidia.com, johannes.thumshirn@wdc.com, kbusch@kernel.org, bvanassche@acm.org, linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org, yangerkun@huawei.com, chengzhihao1@huawei.com, wozizhi@huawei.com Subject: [PATCH V5 8/9] null_blk: serialize configfs attribute stores with device setup Date: Tue, 14 Jul 2026 12:18:04 +0800 Message-ID: <20260714041805.1088702-9-wozizhi@huaweicloud.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260714041805.1088702-1-wozizhi@huaweicloud.com> References: <20260714041805.1088702-1-wozizhi@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: cCh0CgBHWHRkulVq2zKnBA--.54416S12 X-Coremail-Antispam: 1UD129KBjvJXoWxAFWrKFyDGw47tF48JFy3twb_yoW5Kr4kpF Z5Gay3Gw18JF4fX3yDXw4UWF98Aw18ZrW3KrWfJry8C34UZrnavr9rtF4FqFW8J3y3Cr4f ZF47WFsayFWUWFDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUPlb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUAV Cq3wA2048vs2IY020Ec7CjxVAFwI0_Xr0E3s1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0 rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVW8JVW5JwA2z4x0Y4vE2Ix0cI8IcVCY1x0267 AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIEc7Cj xVAFwI0_GcCE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrV C2j2WlYx0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE 7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwACI402YVCY1x02628vn2kIc2xKxwCY1x0262 kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s02 6c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw 0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUCVW8JwCI42IY6xIIjxv20xvE c7CjxVAFwI0_Gr1j6F4UJwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aV AFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8Jr0_Cr1UYxBIdaVFxhVjvjDU0xZF pf9x07UZTmfUUUUU= X-CM-SenderInfo: pzr2x6tkl6x35dzhxuhorxvhhfrp/ Content-Type: text/plain; charset="utf-8" From: Zizhi Wo The NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes (submit_queues, poll_queues) get dev->NAME written again after apply_fn returns, outside its lock; APPLY=3DNULL attributes are entirely lockless. configfs only serializes stores per-open-file, so concurrent stores on separate fds race. For apply_fn attributes, once one store's apply_fn has reconfigured the hardware, a second (losing) store can still overwrite dev->NAME afterwards. This leaves dev->submit_queues out of sync with the live queue count, which is later caught by the WARN_ON_ONCE() in null_map_queues(). For !apply_fn attributes, power_store()'s null_add_dev() validates and builds the device under "lock" but only sets CONFIGURED afterwards. A store slipping in during this window can change a field mid-setup -- for example, zone_nr_conv can be pushed above nr_zones after it has already been clamped, leading to an out-of-bounds dev->zones[] access. Take "lock" in the macro around the apply_fn call, the CONFIGURED test and the field write, and move it out of nullb_apply_submit_queues()/ nullb_apply_poll_queues() so both paths are covered once. This serializes stores with power_store's setup and with each other. Also reset ret to 0 after the input parsing so that within the locked section ret is purely a status code, rather than carrying the byte count returned by nullb_device_##TYPE##_attr_store(). The field is then written only on success via if (!ret), giving a single consistent rule for both the apply_fn and the APPLY=3DNULL paths. Fixes: 45919fbfe1c4 ("null_blk: Enable modifying 'submit_queues' after an i= nstance has been configured") Signed-off-by: Zizhi Wo Reviewed-by: Nilay Shroff --- drivers/block/null_blk/main.c | 22 +++++++--------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index ad6dfed12464..67cd32d28887 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -360,13 +360,17 @@ nullb_device_##NAME##_store(struct config_item *item,= const char *page, \ ret =3D nullb_device_##TYPE##_attr_store(&new_value, page, count);\ if (ret < 0) \ return ret; \ + ret =3D 0; \ + mutex_lock(&lock); \ if (apply_fn) \ ret =3D apply_fn(dev, new_value); \ else if (test_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags)) \ ret =3D -EBUSY; \ + if (!ret) \ + dev->NAME =3D new_value; \ + mutex_unlock(&lock); \ if (ret < 0) \ return ret; \ - dev->NAME =3D new_value; \ return count; \ } \ CONFIGFS_ATTR(nullb_device_, NAME); @@ -430,25 +434,13 @@ static int nullb_update_nr_hw_queues(struct nullb_dev= ice *dev, static int nullb_apply_submit_queues(struct nullb_device *dev, unsigned int submit_queues) { - int ret; - - mutex_lock(&lock); - ret =3D nullb_update_nr_hw_queues(dev, submit_queues, dev->poll_queues); - mutex_unlock(&lock); - - return ret; + return nullb_update_nr_hw_queues(dev, submit_queues, dev->poll_queues); } =20 static int nullb_apply_poll_queues(struct nullb_device *dev, unsigned int poll_queues) { - int ret; - - mutex_lock(&lock); - ret =3D nullb_update_nr_hw_queues(dev, dev->submit_queues, poll_queues); - mutex_unlock(&lock); - - return ret; + return nullb_update_nr_hw_queues(dev, dev->submit_queues, poll_queues); } =20 NULLB_DEVICE_ATTR(size, ulong, NULL); --=20 2.52.0 From nobody Sat Jul 25 20:10:53 2026 Received: from dggsgout12.his.huawei.com (dggsgout12.his.huawei.com [45.249.212.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 362CE242D67; Tue, 14 Jul 2026 04:26:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003179; cv=none; b=btftlMl5ynD389zfNV7CqHc4GjR4DKxgXZ0akfZ+dAFpv3q3UYDuIcm1PpGj9T/yBcjedYINxL4ZqlehtSamWLZPkN0wL9zXR2pYmBN4sM216H2ikP+9dhzExmawmdVTBJ4hiCsiwFF86OmR5mNKwy2cLeKrc4XkIXhkUU4/iAs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784003179; c=relaxed/simple; bh=Xri67HxFXKm5d9etgZfUnq6y7/OgoWlvqJl/JC3Y8GY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sA442HM4P0eLqfKz/OoAQ43BOyXzfJWswKLO8uRSNdvKCBvaeQ9AmPHGP//kj5w6tld7cT4rALlfd/PpIlf+yMtkfffdXSPbaY1geVCaX2IdZ/mKhlonYvCNyMqD4ZJFpagajh/kifxzRBwY7Aokj5q/GHbNxoT0ayplLgSlBVM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=none smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.177]) by dggsgout12.his.huawei.com (SkyGuard) with ESMTPS id 4gzmSm1hV5zKHMMw; Tue, 14 Jul 2026 12:25:44 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.112]) by mail.maildlp.com (Postfix) with ESMTP id 60CDD40590; Tue, 14 Jul 2026 12:26:14 +0800 (CST) Received: from huaweicloud.com (unknown [10.50.85.155]) by APP1 (Coremail) with UTF8SMTPSA id cCh0CgBHWHRkulVq2zKnBA--.54416S13; Tue, 14 Jul 2026 12:26:14 +0800 (CST) From: Zizhi Wo To: axboe@kernel.dk, dlemoal@kernel.org, nilay@linux.ibm.com, kch@nvidia.com, johannes.thumshirn@wdc.com, kbusch@kernel.org, bvanassche@acm.org, linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org, yangerkun@huawei.com, chengzhihao1@huawei.com, wozizhi@huawei.com Subject: [PATCH V5 9/9] null_blk: serialize configfs attribute shows with the file-scope lock Date: Tue, 14 Jul 2026 12:18:05 +0800 Message-ID: <20260714041805.1088702-10-wozizhi@huaweicloud.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260714041805.1088702-1-wozizhi@huaweicloud.com> References: <20260714041805.1088702-1-wozizhi@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: cCh0CgBHWHRkulVq2zKnBA--.54416S13 X-Coremail-Antispam: 1UD129KBjvJXoWxGr45Ww4rWw4rCFWDCw4DArb_yoW5Ww43pF Z8Ka45Wry8Kw17uF4293ykZa45Ww4IyFWUGry5J3WS9w1UGr9IvrZxKFy5Xa4UJ3srtrsI vFsxur93Ca4UArJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUPlb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUAV Cq3wA2048vs2IY020Ec7CjxVAFwI0_Xr0E3s1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0 rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVW8JVW5JwA2z4x0Y4vE2Ix0cI8IcVCY1x0267 AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIEc7Cj xVAFwI0_GcCE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrV C2j2WlYx0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE 7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwACI402YVCY1x02628vn2kIc2xKxwCY1x0262 kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s02 6c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw 0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUCVW8JwCI42IY6xIIjxv20xvE c7CjxVAFwI0_Gr1j6F4UJwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aV AFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8Jr0_Cr1UYxBIdaVFxhVjvjDU0xZF pf9x07UZTmfUUUUU= X-CM-SenderInfo: pzr2x6tkl6x35dzhxuhorxvhhfrp/ Content-Type: text/plain; charset="utf-8" From: Zizhi Wo The _show callback in the NULLB_DEVICE_ATTR macro reads dev->NAME and the _store path writes it. configfs does not serialize accesses across separate open file descriptions (buffer->mutex is per-fd), and _show takes no lock, so a concurrent read and write on the same attribute is a data race. The _show readers also race against writes to these fields that run after the configfs item becomes visible, e.g. in nullb_update_nr_hw_queues(). All of those writers now run under the file-scope lock: _store takes it unconditionally, and the setup-side writers run under power_store() which holds the same lock. The only remaining unsynchronized accesses are the plain reads in _show. Rather than annotating every field with READ_ONCE()/WRITE_ONCE() across files, simply take the file-scope lock in _show (and in power_show) as well. This closes the remaining _show-vs-write data races with a single lock and keeps the writers as plain assignments. configfs attribute access is not on the I/O hot path, so taking the mutex in _show is acceptable from a performance standpoint. The dev fields written in null_alloc_dev() and dev->power in nullb_group_drop_item() need no locking: the former runs from .make_group before the item is published, and the latter is serialized by configfs frag_sem/frag_dead against attribute show/store. Suggested-by: Nilay Shroff Signed-off-by: Zizhi Wo Reviewed-by: Nilay Shroff --- drivers/block/null_blk/main.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index 67cd32d28887..c8487a630e1a 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -345,8 +345,14 @@ static ssize_t nullb_device_bool_attr_store(bool *val,= const char *page, static ssize_t \ nullb_device_##NAME##_show(struct config_item *item, char *page) \ { \ - return nullb_device_##TYPE##_attr_show( \ + ssize_t ret; \ + \ + mutex_lock(&lock); \ + ret =3D nullb_device_##TYPE##_attr_show( \ to_nullb_device(item)->NAME, page); \ + mutex_unlock(&lock); \ + \ + return ret; \ } \ static ssize_t \ nullb_device_##NAME##_store(struct config_item *item, const char *page, \ @@ -479,7 +485,13 @@ NULLB_DEVICE_ATTR(badblocks_partial_io, bool, NULL); =20 static ssize_t nullb_device_power_show(struct config_item *item, char *pag= e) { - return nullb_device_bool_attr_show(to_nullb_device(item)->power, page); + ssize_t ret; + + mutex_lock(&lock); + ret =3D nullb_device_bool_attr_show(to_nullb_device(item)->power, page); + mutex_unlock(&lock); + + return ret; } =20 static ssize_t nullb_device_power_store(struct config_item *item, --=20 2.52.0