From nobody Tue Sep 29 06:58:49 2026 Received: from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 47785426438 for ; Tue, 11 Aug 2026 11:04:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786446289; cv=none; b=Nh96gk8hZ3u88JuzzbOwvIuMxh1UeaAp64GsiYZp+EgSiEqCCvC4/2EHaRXmgdV2xE2FL3BR4OvzDX9kfYriSqrHOwye6Kib2civ17iqvfAJitz/WVOcgNHphNqu+4X/AtkOQtSuHi2+eMP2PZu8qrjsGlomg8vC3MtA9q63KbY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786446289; c=relaxed/simple; bh=atCxkuYL4hRzLwzbyOunU2UxpM3YWWuI9Tod9XDOHxY=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=PYHxYj+u2pRQm6y5vDi5fmW68mDlL9qfEn56kAo9OCGlc4tqRbKErPS3Qrqrk+zqYa6yO+4PpbCA7OXXmGw3eC0NqSAJDg20zU8v/Cq3sI1bne4LOXTABR7kDtHJGI7SQnta6LD2Fw54EM6bmEGei8FRrbZHIJOsAdBAk+0IPVo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=nneAstkH; arc=none smtp.client-ip=209.85.221.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="nneAstkH" Received: by mail-wr1-f53.google.com with SMTP id ffacd0b85a97d-47f93b2fe4cso1611781f8f.0 for ; Tue, 11 Aug 2026 04:04:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786446286; x=1787051086; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=LEHATZupNKkhi1i84uPxQjWjLcsCZYtEP5bp/4g/DpQ=; b=nneAstkHsY22j6wQMmPAVcGZBGnv3EKFyomdG3I/1hYHJExFM3n0HsRWTwFqjINyij V2x3mEAfhkyBzTqDb23rLHmfFWpEFGAWkOzJEwbEPG47ZgN7B/GlazbbVJfDM0eO4zws 2uen8h67cR8SHkRhTjpiebYX/I29mC1aNnZ5Pxj31JLynS6IPKLqwAapFM+7pkqXDWme 2VDWCjC653f0pijo9xi2GQKib1UOZsbVzmUd8ATxKrvU6ces2dlcKnj8xuxXSDb6AL5H mpBZT4ADC6dTaWGh8w/L/bNkQNoQj6d+tMu9TqLgWOZlPdMaPJ9D1V9LFtHfH+8ddIx9 nouw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786446286; x=1787051086; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=LEHATZupNKkhi1i84uPxQjWjLcsCZYtEP5bp/4g/DpQ=; b=GkkqEZBDiKZ6sXjt4DjHUtsB6TEksXqDQwk1bQatm5xVINO9tG6sBhtIIi8gcbW2gG cZBLZ0ImGFPeNK6e4y03stTGlmDNoQ0dtybz80djDsD6EcF+aKlIOkXa+ezgSFoSsC91 aHXB61sgkSMfJmPrgjNCqzGKhKXMK5BGNd+3tqSDhiHT7+K4qPj09wpxETHhKjEioRDa hTwgWZY+RWXfqRG28ndst4pIqBbjmlJZzE7BNR69FrKCk5k/16+SNB8hGNVaKAqDTXlG B1v2UuZeLggHW/Z+e7Qv/HRtBW0FZmXNHosIleov2ggqQ+M8HdpKzqAChBChLxyvpfIC CefA== X-Forwarded-Encrypted: i=1; AHgh+Rp6qvWFD/md3IFJh1Y9YNQ5CxIySXT3m902gxq8qUwgpSeq7LaHmu4HNSxQ2ho3/8iwGIhDSFNYKTxdtO0=@vger.kernel.org X-Gm-Message-State: AOJu0Yx8VifVn9WSNcfGvMvlM7lG9pgIHkdlCw1FAQWMJ8D49Uc0LxRF hyX9ZRt0f6vG0zW8vBmtAckfRopSQYIjF5bb/aEVz1Nf1riLfnk7314t X-Gm-Gg: AR+sD11TL7ZFcma056i7xRE6FfI7ApZStD7mhYff57PITl5XhSFax03GOwmGaacWGAK 9KUOUigkZEi5KRbu3cGA9Ld2/b5eVV9De5jbmdJLUk+Co1sY8PLekVYU6LaSGe/+dajFohaHOSw hGuS+jVsPYJjGJAv1VPR4eSYVN2V9xcxat9jK1h1/m3BIkAMSXz4DfjbDP0A4lWMMBD2K1SnS2N zoFF4RXJUEOKCYFdYxHi2s4Bcu0OjkVkMu65zY9PrPJ58/X184kgDezDgR2ykC9KzMkGgs+N3iV JOEqGdgiW4PgWf0eEK31MRywGwyy9slzmJiTi93ZZ1d09Zo9kKwo8v2b6z9cMK5IlMxUFcNG5ok 664EYLxy1XKJAeA8mbdFXTAckhHIrYkZRajXhZdwV3DmJRygIu4oYASoWtdB2wOzfnsDmX0yzPm OyGTx6Wo4MpYZaaWV+2SLcZ2fXD5VNxYlVh+4OnBz/HjahPBWbIf9qRD8lqufJSd4E7eQkybEum rfY3wSlPr46yJJUM+JIuH0WYYQ+xEQ0L3Dx6TOEW8MMMQ48IBoofwiOavFGO3M3rzvRnnALgY/I qwu5QLuTX73Z+6zR0Dp+SPSTHNJXbBGIc4hGAi6MzRmwx5aBj6vQdc6Oy5zbsfQ1HXsC X-Received: by 2002:a05:6000:4008:b0:47f:f3d4:26da with SMTP id ffacd0b85a97d-4814ad8ed6amr4076784f8f.11.1786446281619; Tue, 11 Aug 2026 04:04:41 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-a133-e401-bc8e-d36c-2d08-c5e0.310.pool.telefonica.de. [2a02:3100:a133:e401:bc8e:d36c:2d08:c5e0]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4814a72cdb8sm3593881f8f.35.2026.08.11.04.04.40 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 11 Aug 2026 04:04:41 -0700 (PDT) From: Karl Mehltretter To: Tejun Heo , Josef Bacik , Jens Axboe Cc: Karl Mehltretter , Ming Lei , Christoph Hellwig , Yi Zhang , cgroups@vger.kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] blk-cgroup: fix lost wakeup in blkg_destroy_all() Date: Tue, 11 Aug 2026 13:04:21 +0200 Message-Id: <20260811110421.50747-1-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" wake_up_var() requires a full barrier between making the wait condition true and its lockless waitqueue check. spin_unlock_irq() has only release semantics, so it does not order q->root_blkg =3D NULL against that check. During disk rebind, blkcg_init_disk() can therefore miss the wakeup and sleep indefinitely. Add the required smp_mb(). Also mark the store with WRITE_ONCE() since the waiter reads root_blkg locklessly with READ_ONCE(). An LKMM model permits the missed-wakeup outcome without the barrier and forbids it with the barrier. Fixes: 3dbaacf6ab68 ("blk-cgroup: wait for blkcg cleanup before initializin= g new disk") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter --- LKMM (herdtools7 7.58), with the store modeled by WRITE_ONCE(). flag is q->root_blkg (1 =3D set), lk the queue_lock, wq the var waitqueue occupancy. To model the fixed code, insert smp_mb() in P0 between smp_store_release(lk, 0) and READ_ONCE(*wq): C blkcg-rebind-buggy { flag=3D1; } P0(int *flag, int *lk, int *wq) { int r0; WRITE_ONCE(*flag, 0); smp_store_release(lk, 0); r0 =3D READ_ONCE(*wq); } P1(int *flag, int *lk, int *wq) { int r1; WRITE_ONCE(*wq, 1); smp_mb(); r1 =3D READ_ONCE(*flag); } exists (0:r0=3D0 /\ 1:r1=3D1) herd7 -conf linux-kernel.cfg blkcg-rebind-buggy.litmus without smp_mb(): Sometimes with smp_mb(): Never block/blk-cgroup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index d9676126c5b5d..2b3cf9caeaa31 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -604,9 +604,11 @@ static void blkg_destroy_all(struct gendisk *disk) __clear_bit(pol->plid, q->blkcg_pols); } - q->root_blkg =3D NULL; + WRITE_ONCE(q->root_blkg, NULL); spin_unlock_irq(&q->queue_lock); + /* Order q->root_blkg store before wake_up_var()'s waitqueue check */ + smp_mb(); wake_up_var(&q->root_blkg); } -- 2.53.0