github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-07 22:14:04 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
480d42dc00
linux/block
History
Andrea Righi 480d42dc00 blk-wbt: prevent NULL pointer dereference in wb_timer_fn 
The timer callback used to evaluate if the latency is exceeded can be
executed after the corresponding disk has been released, causing the
following NULL pointer dereference:

[ 119.987108] BUG: kernel NULL pointer dereference, address: 0000000000000098
[ 119.987617] #PF: supervisor read access in kernel mode
[ 119.987971] #PF: error_code(0x0000) - not-present page
[ 119.988325] PGD 7c4a4067 P4D 7c4a4067 PUD 7bf63067 PMD 0
[ 119.988697] Oops: 0000 [#1] SMP NOPTI
[ 119.988959] CPU: 1 PID: 9353 Comm: cloud-init Not tainted 5.15-rc5+arighi #rc5+arighi
[ 119.989520] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
[ 119.990055] RIP: 0010:wb_timer_fn+0x44/0x3c0
[ 119.990376] Code: 41 8b 9c 24 98 00 00 00 41 8b 94 24 b8 00 00 00 41 8b 84 24 d8 00 00 00 4d 8b 74 24 28 01 d3 01 c3 49 8b 44 24 60 48 8b 40 78 <4c> 8b b8 98 00 00 00 4d 85 f6 0f 84 c4 00 00 00 49 83 7c 24 30 00
[ 119.991578] RSP: 0000:ffffb5f580957da8 EFLAGS: 00010246
[ 119.991937] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004
[ 119.992412] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88f476d7f780
[ 119.992895] RBP: ffffb5f580957dd0 R08: 0000000000000000 R09: 0000000000000000
[ 119.993371] R10: 0000000000000004 R11: 0000000000000002 R12: ffff88f476c84500
[ 119.993847] R13: ffff88f4434390c0 R14: 0000000000000000 R15: ffff88f4bdc98c00
[ 119.994323] FS: 00007fb90bcd9c00(0000) GS:ffff88f4bdc80000(0000) knlGS:0000000000000000
[ 119.994952] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 119.995380] CR2: 0000000000000098 CR3: 000000007c0d6000 CR4: 00000000000006e0
[ 119.995906] Call Trace:
[ 119.996130] ? blk_stat_free_callback_rcu+0x30/0x30
[ 119.996505] blk_stat_timer_fn+0x138/0x140
[ 119.996830] call_timer_fn+0x2b/0x100
[ 119.997136] __run_timers.part.0+0x1d1/0x240
[ 119.997470] ? kvm_clock_get_cycles+0x11/0x20
[ 119.997826] ? ktime_get+0x3e/0xa0
[ 119.998110] ? native_apic_msr_write+0x2c/0x30
[ 119.998456] ? lapic_next_event+0x20/0x30
[ 119.998779] ? clockevents_program_event+0x94/0xf0
[ 119.999150] run_timer_softirq+0x2a/0x50
[ 119.999465] __do_softirq+0xcb/0x26f
[ 119.999764] irq_exit_rcu+0x8c/0xb0
[ 120.000057] sysvec_apic_timer_interrupt+0x43/0x90
[ 120.000429] ? asm_sysvec_apic_timer_interrupt+0xa/0x20
[ 120.000836] asm_sysvec_apic_timer_interrupt+0x12/0x20

In this case simply return from the timer callback (no action
required) to prevent the NULL pointer dereference.

BugLink: https://bugs.launchpad.net/bugs/1947557
Link: https://lore.kernel.org/linux-mm/YWRNVTk9N8K0RMst@arighi-desktop/
Fixes: 34dbad5d26 ("blk-stat: convert to callback-based statistics reporting")
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Link: https://lore.kernel.org/r/YW6N2qXpBU3oc50q@arighi-desktop
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2021-10-19 06:13:41 -06:00
..
partitions block: convert the rest of block to bdev_get_queue 2021-10-18 06:17:37 -06:00
badblocks.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
bdev.c block: use bdev_get_queue() in bdev.c 2021-10-18 06:17:36 -06:00
bfq-cgroup.c block: move elevator.h to block/ 2021-10-18 06:17:01 -06:00
bfq-iosched.c blk-mq: Stop using pointers for blk_mq_tags bitmap tags 2021-10-18 06:17:03 -06:00
bfq-iosched.h block, bfq: cleanup the repeated declaration 2021-08-25 06:45:33 -06:00
bfq-wf2q.c block: Introduce IOPRIO_NR_LEVELS 2021-08-18 07:21:12 -06:00
bio-integrity.c block: convert the rest of block to bdev_get_queue 2021-10-18 06:17:37 -06:00
bio.c block: don't bother iter advancing a fully done bio 2021-10-18 08:50:16 -06:00
blk-cgroup-rwstat.c blk-cgroup: Fix the recursive blkg rwstat 2021-03-05 11:32:15 -07:00
blk-cgroup-rwstat.h
blk-cgroup.c block: convert the rest of block to bdev_get_queue 2021-10-18 06:17:37 -06:00
blk-core.c block: add a struct io_comp_batch argument to fops->iopoll() 2021-10-18 14:40:40 -06:00
blk-crypto-fallback.c block: move struct request to blk-mq.h 2021-10-18 06:17:02 -06:00
blk-crypto-internal.h block: move struct request to blk-mq.h 2021-10-18 06:17:02 -06:00
blk-crypto.c block: convert the rest of block to bdev_get_queue 2021-10-18 06:17:37 -06:00
blk-exec.c block: add a struct io_comp_batch argument to fops->iopoll() 2021-10-18 14:40:40 -06:00
blk-flush.c blk-mq: fix is_flush_rq 2021-08-17 20:17:34 -06:00
blk-integrity.c block: move integrity handling out of <linux/blkdev.h> 2021-10-18 06:17:02 -06:00
blk-ioc.c block: remove retry loop in ioc_release_fn() 2020-07-16 10:22:15 -06:00
blk-iocost.c block: convert the rest of block to bdev_get_queue 2021-10-18 06:17:37 -06:00
blk-iolatency.c mm: don't include <linux/blk-cgroup.h> in <linux/backing-dev.h> 2021-10-18 06:17:01 -06:00
blk-ioprio.c block: Introduce the ioprio rq-qos policy 2021-06-21 15:03:40 -06:00
blk-ioprio.h block: Introduce the ioprio rq-qos policy 2021-06-21 15:03:40 -06:00
blk-lib.c block: export blk_next_bio() 2021-06-17 15:51:20 +02:00
blk-map.c Merge branch 'akpm' (patches from Andrew) 2021-09-03 10:08:28 -07:00
blk-merge.c block: return whether or not to unplug through boolean 2021-10-19 05:55:04 -06:00
blk-mq-cpumap.c blk-mq: remove the calling of local_memory_node() 2020-10-20 07:08:17 -06:00
blk-mq-debugfs-zoned.c
blk-mq-debugfs.c block: remove some blk_mq_hw_ctx debugfs entries 2021-10-18 14:40:33 -06:00
blk-mq-debugfs.h
blk-mq-pci.c
blk-mq-rdma.c
blk-mq-sched.c block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes 2021-10-18 14:39:48 -06:00
blk-mq-sched.h block: store elevator state in request 2021-10-18 08:51:52 -06:00
blk-mq-sysfs.c block: remove blk-mq-sysfs dead code 2021-08-02 13:37:29 -06:00
blk-mq-tag.c block: add support for blk_mq_end_request_batch() 2021-10-18 14:40:43 -06:00
blk-mq-tag.h block: move blk_mq_tag_to_rq() inline 2021-10-19 05:55:41 -06:00
blk-mq-virtio.c
blk-mq.c block: move blk_mq_tag_to_rq() inline 2021-10-19 05:55:41 -06:00
blk-mq.h block: add a struct io_comp_batch argument to fops->iopoll() 2021-10-18 14:40:40 -06:00
blk-pm.c scsi: block: Fix a race in the runtime power management code 2020-12-09 11:41:41 -05:00
blk-pm.h block: Remove unused blk_pm_*() function definitions 2021-02-22 06:33:48 -07:00
blk-rq-qos.c rq-qos: fix missed wake-ups in rq_qos_throttle try two 2021-06-08 15:12:57 -06:00
blk-rq-qos.h block: only mark bio as tracked if it really is tracked 2021-10-18 08:50:47 -06:00
blk-settings.c block: add an explicit ->disk backpointer to the request_queue 2021-08-23 12:54:31 -06:00
blk-stat.c blk-stat: make q->stats->lock irqsafe 2020-09-01 16:48:46 -06:00
blk-stat.h
blk-sysfs.c block: don't allow writing to the poll queue attribute 2021-10-18 06:17:36 -06:00
blk-throttle.c block: convert the rest of block to bdev_get_queue 2021-10-18 06:17:37 -06:00
blk-throttle.h block: move blk-throtl fast path inline 2021-10-18 06:17:03 -06:00
blk-timeout.c block: blk-timeout: delete duplicated word 2020-07-31 16:29:47 -06:00
blk-wbt.c blk-wbt: prevent NULL pointer dereference in wb_timer_fn 2021-10-19 06:13:41 -06:00
blk-wbt.h blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled() 2021-06-21 15:03:41 -06:00
blk-zoned.c blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN 2021-08-24 10:12:36 -06:00
blk.h block: return whether or not to unplug through boolean 2021-10-19 05:55:04 -06:00
bounce.c mm: don't include <linux/blk-cgroup.h> in <linux/backing-dev.h> 2021-10-18 06:17:01 -06:00
bsg-lib.c scsi: bsg-lib: Fix commands without data transfer in bsg_transport_sg_io_fn() 2021-08-01 13:21:40 -04:00
bsg.c scsi: bsg: Fix device unregistration 2021-09-14 00:22:15 -04:00
disk-events.c block: return errors from disk_alloc_events 2021-08-23 12:55:45 -06:00
elevator.c blk-mq: Change shared sbitmap naming to shared tags 2021-10-18 06:17:03 -06:00
elevator.h block: move elevator.h to block/ 2021-10-18 06:17:01 -06:00
fops.c block: align blkdev_dio inlined bio to a cacheline 2021-10-19 05:55:52 -06:00
genhd.c block: move bdev_read_only() into the header 2021-10-19 05:53:22 -06:00
holder.c block: drop unused includes in <linux/genhd.h> 2021-10-18 06:17:02 -06:00
ioctl.c block: merge block_ioctl into blkdev_ioctl 2021-10-18 06:17:34 -06:00
ioprio.c block: fix default IO priority handling 2021-08-18 07:23:15 -06:00
Kconfig block: move menu "Partition type" to block/partitions/Kconfig 2021-10-18 06:17:35 -06:00
Kconfig.iosched block: simplify Kconfig files 2021-10-18 06:17:35 -06:00
keyslot-manager.c block: move integrity handling out of <linux/blkdev.h> 2021-10-18 06:17:02 -06:00
kyber-iosched.c blk-mq: Stop using pointers for blk_mq_tags bitmap tags 2021-10-18 06:17:03 -06:00
Makefile block: move CONFIG_BLOCK guard to top Makefile 2021-10-18 06:17:35 -06:00
mq-deadline.c blk-mq: Stop using pointers for blk_mq_tags bitmap tags 2021-10-18 06:17:03 -06:00
opal_proto.h
sed-opal.c
t10-pi.c block: move integrity handling out of <linux/blkdev.h> 2021-10-18 06:17:02 -06:00