Ming Lei 0a9a25ca78 block: let blkcg_gq grab request queue's refcnt
In the whole lifetime of blkcg_gq instance, ->q will be referred, such
as, ->pd_free_fn() is called in blkg_free, and throtl_pd_free() still
may touch the request queue via &tg->service_queue.pending_timer which
is handled by throtl_pending_timer_fn(), so it is reasonable to grab
request queue's refcnt by blkcg_gq instance.

Previously blkcg_exit_queue() is called from blk_release_queue, and it
is hard to avoid the use-after-free. But recently commit 1059699f87eb ("block:
move blkcg initialization/destroy into disk allocation/release handler")
is merged to for-5.18/block, it becomes simple to fix the issue by simply
grabbing request queue's refcnt.

Reported-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20220318130144.1066064-3-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2022-03-18 09:57:56 -06:00
..
2022-02-02 07:49:59 -07:00
2022-02-27 14:52:36 -07:00
2022-02-18 06:13:00 -07:00
2021-12-06 13:18:47 -07:00
2020-03-17 20:55:21 +01:00
2022-03-08 19:39:38 -07:00
2021-09-14 00:22:15 -04:00
2022-02-02 07:49:59 -07:00
2021-10-18 06:17:01 -06:00
2022-02-02 07:49:59 -07:00
2022-01-12 10:26:52 -08:00
2022-02-02 07:49:59 -07:00