linux

mirror of https://github.com/torvalds/linux.git synced 2026-07-30 03:01:41 +02:00

Linux kernel source tree

Go to file

Yu Kuai 433279beba md: fix regression for null-ptr-deference in __md_stop() Commit `3e45352259` ("md: Free resources in __md_stop") tried to fix null-ptr-deference for 'active_io' by moving percpu_ref_exit() to __md_stop(), however, the commit also moving 'writes_pending' to __md_stop(), and this will cause mdadm tests broken: BUG: kernel NULL pointer dereference, address: 0000000000000038 Oops: 0000 [#1] PREEMPT SMP CPU: 15 PID: 17830 Comm: mdadm Not tainted 6.3.0-rc3-next-20230324-00009-g520d37 RIP: 0010:free_percpu+0x465/0x670 Call Trace: <TASK> __percpu_ref_exit+0x48/0x70 percpu_ref_exit+0x1a/0x90 __md_stop+0xe9/0x170 do_md_stop+0x1e1/0x7b0 md_ioctl+0x90c/0x1aa0 blkdev_ioctl+0x19b/0x400 vfs_ioctl+0x20/0x50 __x64_sys_ioctl+0xba/0xe0 do_syscall_64+0x6c/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0xcd And the problem can be reporduced 100% by following test: mdadm -CR /dev/md0 -l1 -n1 /dev/sda --force echo inactive > /sys/block/md0/md/array_state echo read-auto > /sys/block/md0/md/array_state echo inactive > /sys/block/md0/md/array_state Root cause: // start raid raid1_run mddev_init_writes_pending percpu_ref_init // inactive raid array_state_store do_md_stop __md_stop percpu_ref_exit // start raid again array_state_store do_md_run raid1_run mddev_init_writes_pending if (mddev->writes_pending.percpu_count_ptr) // won't reinit // inactive raid again ... percpu_ref_exit -> null-ptr-deference Before the commit, 'writes_pending' is exited when mddev is freed, and it's safe to restart raid because mddev_init_writes_pending() already make sure that 'writes_pending' will only be initialized once. Fix the prblem by moving 'writes_pending' back, it's a litter hard to find the relationship between alloc memory and free memory, however, code changes is much less and we lived with this for a long time already. Fixes: `3e45352259` ("md: Free resources in __md_stop") Signed-off-by: Yu Kuai <yukuai3@huawei.com> Reviewed-by: Xiao Ni <xni@redhat.com> Signed-off-by: Song Liu <song@kernel.org> Link: https://lore.kernel.org/r/20230328094400.1448955-1-yukuai1@huaweicloud.com		2023-03-29 11:30:20 -07:00
arch	cpumask: re-introduce constant-sized cpumask optimizations	2023-03-05 14:30:34 -08:00
block	block: remove obsolete config BLOCK_COMPAT	2023-03-16 09:35:44 -06:00
certs	Kbuild updates for v6.3	2023-02-26 11:53:25 -08:00
crypto	Networking changes for 6.3.	2023-02-21 18:24:12 -08:00
Documentation	docs: sysfs-block: document hidden sysfs entry	2023-03-07 16:40:52 -07:00
drivers	md: fix regression for null-ptr-deference in __md_stop()	2023-03-29 11:30:20 -07:00
fs	17 hotfixes. Eight are for MM and seven are for other parts of the	2023-03-04 13:32:50 -08:00
include	nvme-tcp: fix nvme_tcp_term_pdu to match spec	2023-03-22 09:19:56 +01:00
init	Kbuild updates for v6.3	2023-02-26 11:53:25 -08:00
io_uring	block/io_uring: pass in issue_flags for uring_cmd task_work handling	2023-03-20 20:01:25 -06:00
ipc	Merge branch 'work.namespace' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2023-02-24 19:20:07 -08:00
kernel	A set of updates for the interrupt susbsystem:	2023-03-05 11:19:16 -08:00
lib	cpumask: re-introduce constant-sized cpumask optimizations	2023-03-05 14:30:34 -08:00
LICENSES	LICENSES: Add the copyleft-next-0.3.1 license	2022-11-08 15:44:01 +01:00
mm	mm: avoid gcc complaint about pointer casting	2023-03-04 14:03:27 -08:00
net	nfsd-6.3 fixes:	2023-03-01 11:03:44 -08:00
rust	Rust fixes for 6.3-rc1	2023-03-03 14:51:15 -08:00
samples	LoongArch changes for v6.3	2023-03-01 09:27:00 -08:00
scripts	Remove Intel compiler support	2023-03-05 10:49:37 -08:00
security	capability: just use a 'u64' instead of a 'u32[2]' array	2023-03-01 10:01:22 -08:00
sound	sound fixes for 6.3-rc1	2023-03-04 10:53:59 -08:00
tools	Changes in this cycle were:	2023-03-02 09:45:34 -08:00
usr	usr/gen_init_cpio.c: remove unnecessary -1 values from int file	2022-10-03 14:21:44 -07:00
virt	KVM/riscv changes for 6.3	2023-02-15 12:33:28 -05:00
.clang-format	cpumask: re-introduce constant-sized cpumask optimizations	2023-03-05 14:30:34 -08:00
.cocciconfig
.get_maintainer.ignore	get_maintainer: add Alan to .get_maintainer.ignore	2022-08-20 15:17:44 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for *.dtso files	2023-02-26 15:28:23 +09:00
.gitignore	.gitignore: ignore .cover and .mbx	2023-02-05 18:51:22 +09:00
.mailmap	mailmap: map Dikshita Agarwal's old address to his current one	2023-03-02 21:54:24 -08:00
.rustfmt.toml	rust: add `.rustfmt.toml`	2022-09-28 09:02:20 +02:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
Kbuild	Kbuild updates for v6.1	2022-10-10 12:00:45 -07:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	MAINTAINERS: repair malformed T: entries in NVM EXPRESS DRIVERS	2023-03-15 14:43:46 +01:00
Makefile	Linux 6.3-rc1	2023-03-05 14:52:03 -08:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.