[PATCH v3] block: avoid long sync_blockdev() under disk->open_mutex during parallel close

[Tetsuo Handa]

Commit b849dd84b6cc ("bdev: Reduce time holding bd_mutex in sync in
blkdev_close()") introduced a sync_blockdev() call immediately before
holding disk->open_mutex. But this check was racy and best-effort basis.

If more than one process concurrently called bdev_release() and saw
atomic_read(&bdev->bd_openers) > 1, the process which actually hit
the atomic_dec_and_test(&bdev->bd_openers) condition will call
sync_blockdev() from blkdev_flush_mapping() (which could take several
minutes) with disk->open_mutex held.

Kill this race window and make sync_blockdev() always be called before
holding disk->open_mutex, by using a marker that checks whether lockless
sync_blockdev() has raced.

Assisted-by: Gemini-Pro
Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
---
 block/bdev.c              | 35 +++++++++++++++++++++++++++++++++--
 include/linux/blk_types.h |  1 +
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/block/bdev.c b/block/bdev.c
index cd8323083740..c71dacd0c2b1 100644
--- a/block/bdev.c
+++ b/block/bdev.c
@@ -1155,6 +1155,7 @@ void bdev_release(struct file *bdev_file)
 	struct block_device *bdev = file_bdev(bdev_file);
 	void *holder = bdev_file->private_data;
 	struct gendisk *disk = bdev->bd_disk;
+	struct block_device *whole;
 
 	/* We failed to open that block device. */
 	if (IS_ERR(holder))
@@ -1167,10 +1168,40 @@ void bdev_release(struct file *bdev_file)
 	 * of the world and we want to avoid long (could be several minute)
 	 * syncs while holding the mutex.
 	 */
-	if (atomic_read(&bdev->bd_openers) == 1)
+	mutex_lock(&disk->open_mutex);
+	whole = bdev_is_partition(bdev) ? bdev_whole(bdev) : NULL;
+ retry:
+	if ((whole && atomic_read(&whole->bd_openers) == 1) ||
+	    atomic_read(&bdev->bd_openers) == 1) {
+		bdev->bdev_syncer = current;
+		if (whole)
+			whole->bdev_syncer = current;
+		mutex_unlock(&disk->open_mutex);
 		sync_blockdev(bdev);
+		if (whole)
+			sync_blockdev(whole);
+		mutex_lock(&disk->open_mutex);
+		if (bdev->bdev_syncer != current ||
+		    (whole && whole->bdev_syncer != current))
+			goto retry;
+	} else {
+		/*
+		 * Mark sync_blockdev() being possibly raced.
+		 *
+		 * Theoretically, it is possible for a malicious thread to
+		 * trap a victim thread in an infinite "goto retry;" loop
+		 * by repeatedly calling open() and close(). In practice,
+		 * however, trapping a victim thread in such a loop is
+		 * extremely difficult. This is because the bd_opener count
+		 * remains elevated between open() and close() calls,
+		 * meaning the victim thread will observe bd_opener > 1
+		 * and skip synchronization within just a few retries.
+		 */
+		bdev->bdev_syncer = NULL;
+		if (whole)
+			whole->bdev_syncer = NULL;
+	}
 
-	mutex_lock(&disk->open_mutex);
 	bdev_yield_write_access(bdev_file);
 
 	if (holder)
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 98e21b4cbf32..d79bb4b6100f 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -74,6 +74,7 @@ struct block_device {
 #ifdef CONFIG_SECURITY
 	void			*bd_security;
 #endif
+	struct task_struct	*bdev_syncer; /* Not refcounted. */
 	/*
 	 * keep this out-of-line as it's both big and not needed in the fast
 	 * path
-- 
2.56.0