[PATCH v1] block/mq-deadline: hold elevator_lock in debugfs next_rq show

[Xixin Liu]

deadline_*_next_rq_show() dereferences q->elevator->elevator_data without
holding elevator_lock.  Concurrent elevator switch to "none" clears
q->elevator under that lock and tears down the scheduler, so readers
crash with a null-ptr-deref.

Hold elevator_lock around the show path and bail out if the elevator has
already been removed, matching other blk-mq debugfs readers that look at
elevator state.

Reproduced on linux-next with KASAN by reading write1_next_rq via debugfs
while switching the elevator from mq-deadline to none under fio load:

 BUG: KASAN: null-ptr-deref in deadline_write1_next_rq_show+0x3c/0xf0
 Read of size 8 at addr 0000000000000010 by task cat/140857
 Call trace:
  deadline_write1_next_rq_show+0x3c/0xf0
  blk_mq_debugfs_show+0x58/0x78
  seq_read_iter+0x254/0x6f8
  seq_read+0x1a0/0x220
  vfs_read+0x14c/0x528

Signed-off-by: Xixin Liu <liuxixin@xxxxxxxxxx>
---
 block/mq-deadline.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index 824bfc17b2c6..e7c4a91b2d08 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -842,14 +842,22 @@ static int deadline_##name##_next_rq_show(void *data,			\
 					  struct seq_file *m)		\
 {									\
 	struct request_queue *q = data;					\
-	struct deadline_data *dd = q->elevator->elevator_data;		\
-	struct dd_per_prio *per_prio = &dd->per_prio[prio];		\
+	struct elevator_queue *e;					\
+	struct deadline_data *dd;					\
+	struct dd_per_prio *per_prio;					\
 	struct request *rq;						\
+	int ret;							\
 									\
+	ret = mutex_lock_interruptible(&q->elevator_lock);		\
+	if (ret)							\
+		return ret;						\
+	e = q->elevator;						\
+	if (!e)								\
+		goto unlock;						\
+	dd = e->elevator_data;						\
+	per_prio = &dd->per_prio[prio];					\
 	rq = deadline_from_pos(per_prio, data_dir,			\
 			       per_prio->latest_pos[data_dir]);		\
 	if (rq)								\
 		__blk_mq_debugfs_rq_show(m, rq);			\
+unlock:									\
+	mutex_unlock(&q->elevator_lock);				\
 	return 0;							\
 }
 
-- 
2.43.0