ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd

ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but
we may have scheduled task work via io_uring_cmd_complete_in_task() for
dispatching request, then kernel crash can be triggered.

Fix it by not trying to canceling the command if ublk block request is
started.

Fixes: 216c8f5ef0f2 ("ublk: replace monitor with cancelable uring_cmd")
Reported-by: Jared Holzman <jholzman@nvidia.com>
Tested-by: Jared Holzman <jholzman@nvidia.com>
Closes: https://lore.kernel.org/linux-block/d2179120-171b-47ba-b664-23242981ef19@nvidia.com/
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250425013742.1079549-3-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index c4d4be4f6fbdaa42d4fe3a348a330fdee693801f..40f971a66d3eb2dbf90bc1e87e6b63a5bd4144c5 100644 (file)
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1683,14 +1683,31 @@ static void ublk_start_cancel(struct ublk_queue *ubq)
        ublk_put_disk(disk);
 }
 
-static void ublk_cancel_cmd(struct ublk_queue *ubq, struct ublk_io *io,
+static void ublk_cancel_cmd(struct ublk_queue *ubq, unsigned tag,
                unsigned int issue_flags)
 {
+       struct ublk_io *io = &ubq->ios[tag];
+       struct ublk_device *ub = ubq->dev;
+       struct request *req;
        bool done;
 
        if (!(io->flags & UBLK_IO_FLAG_ACTIVE))
                return;
 
+       /*
+        * Don't try to cancel this command if the request is started for
+        * avoiding race between io_uring_cmd_done() and
+        * io_uring_cmd_complete_in_task().
+        *
+        * Either the started request will be aborted via __ublk_abort_rq(),
+        * then this uring_cmd is canceled next time, or it will be done in
+        * task work function ublk_dispatch_req() because io_uring guarantees
+        * that ublk_dispatch_req() is always called
+        */
+       req = blk_mq_tag_to_rq(ub->tag_set.tags[ubq->q_id], tag);
+       if (req && blk_mq_request_started(req))
+               return;
+
        spin_lock(&ubq->cancel_lock);
        done = !!(io->flags & UBLK_IO_FLAG_CANCELED);
        if (!done)
@@ -1722,7 +1739,6 @@ static void ublk_uring_cmd_cancel_fn(struct io_uring_cmd *cmd,
        struct ublk_uring_cmd_pdu *pdu = ublk_get_uring_cmd_pdu(cmd);
        struct ublk_queue *ubq = pdu->ubq;
        struct task_struct *task;
-       struct ublk_io *io;
 
        if (WARN_ON_ONCE(!ubq))
                return;
@@ -1737,9 +1753,8 @@ static void ublk_uring_cmd_cancel_fn(struct io_uring_cmd *cmd,
        if (!ubq->canceling)
                ublk_start_cancel(ubq);
 
-       io = &ubq->ios[pdu->tag];
-       WARN_ON_ONCE(io->cmd != cmd);
-       ublk_cancel_cmd(ubq, io, issue_flags);
+       WARN_ON_ONCE(ubq->ios[pdu->tag].cmd != cmd);
+       ublk_cancel_cmd(ubq, pdu->tag, issue_flags);
 }
 
 static inline bool ublk_queue_ready(struct ublk_queue *ubq)
@@ -1752,7 +1767,7 @@ static void ublk_cancel_queue(struct ublk_queue *ubq)
        int i;
 
        for (i = 0; i < ubq->q_depth; i++)
-               ublk_cancel_cmd(ubq, &ubq->ios[i], IO_URING_F_UNLOCKED);
+               ublk_cancel_cmd(ubq, i, IO_URING_F_UNLOCKED);
 }
 
 /* Cancel all pending commands, must be called after del_gendisk() returns */