blk-mq: use queue_hctx in blk_mq_map_queue_type

poluo · axboe · commit 4d0e1f2139ad · 2025-12-01T07:18:31.000-07:00
Some caller of blk_mq_map_queue_type now didn't grab 'q_usage_counter', such as blk_mq_cpu_mapped_to_hctx, so we need protect 'queue_hw_ctx' through rcu. Also checked all other functions, no more missed cases. Fixes: 89e1fb7 ("blk-mq: fix potential uaf for 'queue_hw_ctx'") Reported-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Fengnan Chang <changfengnan@bytedance.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
diff --git a/block/blk-mq.h b/block/blk-mq.h
@@ -84,7 +84,7 @@ static inline struct blk_mq_hw_ctx *blk_mq_map_queue_type(struct request_queue *
 							  enum hctx_type type,
 							  unsigned int cpu)
 {
-	return q->queue_hw_ctx[q->tag_set->map[type].mq_map[cpu]];
+	return queue_hctx((q), (q->tag_set->map[type].mq_map[cpu]));
 }
 
 static inline enum hctx_type blk_mq_get_hctx_type(blk_opf_t opf)

Original file line number	Diff line number	Diff line change
`@@ -84,7 +84,7 @@ static inline struct blk_mq_hw_ctx blk_mq_map_queue_type(struct request_queue `
`84`	`84`	`enum hctx_type type,`
`85`	`85`	`unsigned int cpu)`
`86`	`86`	`{`
`87`		`- return q->queue_hw_ctx[q->tag_set->map[type].mq_map[cpu]];`
	`87`	`+ return queue_hctx((q), (q->tag_set->map[type].mq_map[cpu]));`
`88`	`88`	`}`
`89`	`89`
`90`	`90`	`static inline enum hctx_type blk_mq_get_hctx_type(blk_opf_t opf)`