github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-08 14:42:37 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
0e2af9b06c
linux/drivers/block
History
Bob Liu c8f75e7537 block: null_blk: fix race condition for null_del_dev 
[ Upstream commit 7602843fd8 ]

Dulicate call of null_del_dev() will trigger null pointer error like below.
The reason is a race condition between nullb_device_power_store() and
nullb_group_drop_item().

  CPU#0                         CPU#1
  ----------------              -----------------
  do_rmdir()
   >configfs_rmdir()
    >client_drop_item()
     >nullb_group_drop_item()
                                nullb_device_power_store()
				>null_del_dev()

      >test_and_clear_bit(NULLB_DEV_FL_UP
       >null_del_dev()
       ^^^^^
       Duplicated null_dev_dev() triger null pointer error

				>clear_bit(NULLB_DEV_FL_UP

The fix could be keep the sequnce of clear NULLB_DEV_FL_UP and null_del_dev().

[  698.613600] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
[  698.613608] #PF error: [normal kernel read fault]
[  698.613611] PGD 0 P4D 0
[  698.613619] Oops: 0000 [#1] SMP PTI
[  698.613627] CPU: 3 PID: 6382 Comm: rmdir Not tainted 5.0.0+ #35
[  698.613631] Hardware name: LENOVO 20LJS2EV08/20LJS2EV08, BIOS R0SET33W (1.17 ) 07/18/2018
[  698.613644] RIP: 0010:null_del_dev+0xc/0x110 [null_blk]
[  698.613649] Code: 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b eb 97 e8 47 bb 2a e8 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 54 53 <8b> 77 18 48 89 fb 4c 8b 27 48 c7 c7 40 57 1e c1 e8 bf c7 cb e8 48
[  698.613654] RSP: 0018:ffffb887888bfde0 EFLAGS: 00010286
[  698.613659] RAX: 0000000000000000 RBX: ffff9d436d92bc00 RCX: ffff9d43a9184681
[  698.613663] RDX: ffffffffc11e5c30 RSI: 0000000068be6540 RDI: 0000000000000000
[  698.613667] RBP: ffffb887888bfdf0 R08: 0000000000000001 R09: 0000000000000000
[  698.613671] R10: ffffb887888bfdd8 R11: 0000000000000f16 R12: ffff9d436d92bc08
[  698.613675] R13: ffff9d436d94e630 R14: ffffffffc11e5088 R15: ffffffffc11e5000
[  698.613680] FS:  00007faa68be6540(0000) GS:ffff9d43d14c0000(0000) knlGS:0000000000000000
[  698.613685] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  698.613689] CR2: 0000000000000018 CR3: 000000042f70c002 CR4: 00000000003606e0
[  698.613693] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  698.613697] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  698.613700] Call Trace:
[  698.613712]  nullb_group_drop_item+0x50/0x70 [null_blk]
[  698.613722]  client_drop_item+0x29/0x40
[  698.613728]  configfs_rmdir+0x1ed/0x300
[  698.613738]  vfs_rmdir+0xb2/0x130
[  698.613743]  do_rmdir+0x1c7/0x1e0
[  698.613750]  __x64_sys_rmdir+0x17/0x20
[  698.613759]  do_syscall_64+0x5a/0x110
[  698.613768]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Signed-off-by: Bob Liu <bob.liu@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-07-26 09:14:07 +02:00
..
aoe drivers/block/aoe/aoedev: NULL check is not needed for mempool_destroy 2018-08-08 09:17:20 -06:00
drbd drbd: skip spurious timeout (ping-timeo) when failing promote 2019-02-12 19:47:14 +01:00
mtip32xx Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax 2018-08-26 11:48:42 -07:00
paride block: paride: pd: mark expected switch fall-throughs 2018-08-09 10:17:38 -06:00
rsxx Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax 2018-08-26 11:48:42 -07:00
xen-blkback xen/blkback: remove unused pers_gnts_lock from struct xen_blkif_ring 2018-08-27 12:12:04 -04:00
zram zram: pass down the bvec we need to read into in the work struct 2019-05-02 09:58:53 +02:00
amiflop.c genhd: Rename get_disk() to get_disk_and_module() 2018-02-26 09:48:42 -07:00
ataflop.c ataflop: fix error handling during setup 2018-11-13 11:08:20 -08:00
brd.c brd: re-enable __GFP_HIGHMEM in brd_insert_page() 2019-05-25 18:23:24 +02:00
cryptoloop.c block: cryptoloop - Fix build warning 2017-09-26 07:41:22 -06:00
DAC960.c block/DAC960.c: make some arrays static const, shrinks object size 2018-08-21 11:00:17 -06:00
DAC960.h DAC960: don't use block layer bounce buffers 2018-05-11 15:07:54 -06:00
floppy.c floppy: check_events callback should not return a negative number 2019-03-23 20:09:45 +01:00
Kconfig cdrom: Use struct scsi_sense_hdr internally 2018-08-02 15:22:39 -06:00
loop.c loop: do not print warn message if partition scan is successful 2019-05-02 09:58:52 +02:00
loop.h block/loop: Use global lock for ioctl() operation. 2019-01-22 21:40:36 +01:00
Makefile block: Rename the null_blk_mod kernel module back into null_blk 2018-07-24 09:54:36 -06:00
nbd.c nbd: Use set_blocksize() to set device blocksize 2019-01-22 21:40:38 +01:00
null_blk_main.c block: null_blk: fix race condition for null_del_dev 2019-07-26 09:14:07 +02:00
null_blk_zoned.c null_blk: fix zoned support for non-rq based operation 2018-09-12 18:21:11 -06:00
null_blk.h null_blk: fix zoned support for non-rq based operation 2018-09-12 18:21:11 -06:00
pktcdvd.c pktcdvd: fix setting of 'ret' error return for a few cases 2018-08-16 14:09:28 -06:00
ps3disk.c ps3disk: handle highmem pages 2018-05-11 15:08:03 -06:00
ps3vram.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
rbd_types.h rbd: RBD_V{1,2}_DATA_FORMAT macros 2017-02-20 12:16:15 +01:00
rbd.c rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set 2019-01-16 22:04:36 +01:00
skd_main.c block: skd: Use %pad printk format for dma_addr_t values 2018-07-12 15:01:28 -06:00
skd_s1120.h skd: Use __packed only when needed 2017-08-18 08:45:29 -06:00
sunvdc.c sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN 2019-02-12 19:47:03 +01:00
swim_asm.S
swim.c swim: fix cleanup on setup error 2018-11-13 11:08:20 -08:00
swim3.c block/swim3: Fix -EBUSY error when re-opening device after unmount 2019-02-12 19:47:18 +01:00
sx8.c block: sanitize blk_get_request calling conventions 2018-05-14 08:55:12 -06:00
umem.c block: Fix a race between the cgroup code and request queue initialization 2018-02-28 12:23:35 -07:00
umem.h
virtio_blk.c virtio-blk: limit number of hw queues by nr_cpu_ids 2019-05-10 17:54:09 +02:00
xen-blkfront.c xen-blkfront: switch kcalloc to kvcalloc for large array allocation 2019-06-11 12:20:53 +02:00
xsysace.c xsysace: Fix error handling in ace_setup 2019-05-08 07:21:51 +02:00
z2ram.c treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00