block: do not allow updates through sysfs until registration completes

When a new disk shows up, sysfs queue directory is created before elevator
is registered. This allows a user to attempt a scheduler switch even though
the initial registration hasn't completed yet.

In one scenario, blk_register_queue() calls elv_register_queue() and
right before cfq_registered_queue() is called, another process executes
elevator_switch() and replaces q->elevator with deadline scheduler. When
cfq_registered_queue() executes it interprets e->elevator_data as struct
cfq_data even though it is actually struct deadline_data.

Grab q->sysfs_lock in blk_register_queue() to synchronize with sysfs
callers.

Signed-off-by: Tahsin Erdogan <tahsin@google.com>
Signed-off-by: Jens Axboe <axboe@fb.com>

diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 070d81bae1d50af56fbc4d1a6135b54e7ede82f8..002af836aa87d8444e5682921570ea6dba23fa13 100644 (file)
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -902,17 +902,20 @@ int blk_register_queue(struct gendisk *disk)
        if (ret)
                return ret;
 
+       if (q->mq_ops)
+               blk_mq_register_dev(dev, q);
+
+       /* Prevent changes through sysfs until registration is completed. */
+       mutex_lock(&q->sysfs_lock);
+
        ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue");
        if (ret < 0) {
                blk_trace_remove_sysfs(dev);
-               return ret;
+               goto unlock;
        }
 
        kobject_uevent(&q->kobj, KOBJ_ADD);
 
-       if (q->mq_ops)
-               blk_mq_register_dev(dev, q);
-
        blk_wb_init(q);
 
        if (q->request_fn || (q->mq_ops && q->elevator)) {
@@ -922,11 +925,13 @@ int blk_register_queue(struct gendisk *disk)
                        kobject_del(&q->kobj);
                        blk_trace_remove_sysfs(dev);
                        kobject_put(&dev->kobj);
-                       return ret;
+                       goto unlock;
                }
        }
-
-       return 0;
+       ret = 0;
+unlock:
+       mutex_unlock(&q->sysfs_lock);
+       return ret;
 }
 
 void blk_unregister_queue(struct gendisk *disk)