Re: [syzbot] [block?] [trace?] INFO: task hung in blk_trace_remove (2)

From: Edward Adam Davis
Date: Wed Jan 31 2024 - 03:29:48 EST


please test task hung in blk_trace_remove

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index d5d94510afd3..1af3c8aa78a3 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -311,7 +311,7 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
local_irq_restore(flags);
}

-static void blk_trace_free(struct request_queue *q, struct blk_trace *bt)
+static void blk_trace_free_top(struct request_queue *q, struct blk_trace *bt)
{
relay_close(bt->rchan);

@@ -325,11 +325,21 @@ static void blk_trace_free(struct request_queue *q, struct blk_trace *bt)
} else {
debugfs_remove(bt->dir);
}
+}
+
+static void blk_trace_free_bt(struct blk_trace *bt)
+{
free_percpu(bt->sequence);
free_percpu(bt->msg_data);
kfree(bt);
}

+static void blk_trace_free(struct request_queue *q, struct blk_trace *bt)
+{
+ blk_trace_free_top(q, bt);
+ blk_trace_free_bt(bt);
+}
+
static void get_probe_ref(void)
{
mutex_lock(&blk_probe_mutex);
@@ -377,12 +387,23 @@ static int blk_trace_stop(struct blk_trace *bt)
return 0;
}

+static void blk_trace_rcu_free(struct rcu_head *rcu)
+{
+ struct blk_trace *bt;
+
+ bt = container_of(rcu, struct blk_trace, rcu);
+ if (bt)
+ blk_trace_free_bt(bt);
+}
+
static void blk_trace_cleanup(struct request_queue *q, struct blk_trace *bt)
{
blk_trace_stop(bt);
- synchronize_rcu();
- blk_trace_free(q, bt);
+ blk_trace_free_top(q, bt);
put_probe_ref();
+ mutex_unlock(&q->debugfs_mutex);
+ call_rcu(&bt->rcu, blk_trace_rcu_free);
+ mutex_lock(&q->debugfs_mutex);
}

static int __blk_trace_remove(struct request_queue *q)
diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
index 122c62e561fc..5f927328b7e6 100644
--- a/include/linux/blktrace_api.h
+++ b/include/linux/blktrace_api.h
@@ -26,6 +26,7 @@ struct blk_trace {
struct dentry *dir;
struct list_head running_list;
atomic_t dropped;
+ struct rcu_head rcu;
};

extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);