From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754522AbcKUNVu (ORCPT ); Mon, 21 Nov 2016 08:21:50 -0500 Received: from mx2.suse.de ([195.135.220.15]:50466 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753261AbcKUNVt (ORCPT ); Mon, 21 Nov 2016 08:21:49 -0500 From: Takashi Iwai To: Minchan Kim , Nitin Gupta Cc: Sergey Senozhatsky , David Disseldorp , linux-kernel@vger.kernel.org Subject: [PATCH] zram: Fix unbalanced idr management at hot removal Date: Mon, 21 Nov 2016 14:21:40 +0100 Message-Id: <20161121132140.12683-1-tiwai@suse.de> X-Mailer: git-send-email 2.10.2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The zram hot removal code calls idr_remove() even when zram_remove() returns an error (typically -EBUSY). This results in a leftover at the device release, eventually leading to a crash when the module is reloaded. As described in the bug report below, the following procedure would cause an Oops with zram: - provision three zram devices via modprobe zram num_devices=3 - configure a size for each device + echo "1G" > /sys/block/$zram_name/disksize - mkfs and mount zram0 only - attempt to hot remove all three devices + echo 2 > /sys/class/zram-control/hot_remove + echo 1 > /sys/class/zram-control/hot_remove + echo 0 > /sys/class/zram-control/hot_remove - zram0 removal fails with EBUSY, as expected - unmount zram0 - try zram0 hot remove again + echo 0 > /sys/class/zram-control/hot_remove - fails with ENODEV (unexpected) - unload zram kernel module + completes successfully - zram0 device node still exists - attempt to mount /dev/zram0 + mount command is killed + following BUG is encountered BUG: unable to handle kernel paging request at ffffffffa0002ba0 IP: [] get_disk+0x16/0x50 Oops: 0000 [#1] SMP CPU: 0 PID: 252 Comm: mount Not tainted 4.9.0-rc6 #176 task: ffff88001a9f2800 task.stack: ffffc90000300000 RIP: 0010:[] [] get_disk+0x16/0x50 Call Trace: [] exact_lock+0xc/0x20 [] kobj_lookup+0xdc/0x160 [] ? disk_map_sector_rcu+0x70/0x70 [] ? blkdev_get_by_dev+0x50/0x50 [] get_gendisk+0x2f/0x110 [] ? blkdev_get_by_dev+0x50/0x50 [] __blkdev_get+0x10c/0x3c0 [] ? blkdev_get_by_dev+0x50/0x50 [] blkdev_get+0x19d/0x2e0 [] ? blkdev_get_by_dev+0x50/0x50 [] blkdev_open+0x56/0x70 [] do_dentry_open.isra.19+0x1ff/0x310 [] vfs_open+0x43/0x60 [] path_openat+0x2c9/0xf30 [] ? __save_stack_trace+0x40/0xd0 [] do_filp_open+0x79/0xd0 [] ? kmemleak_alloc+0x49/0xa0 [] do_sys_open+0x114/0x1e0 [] SyS_open+0x19/0x20 [] entry_SYSCALL_64_fastpath+0x13/0x94 This patch adds the proper error check in hot_remove_store() not to call idr_remove() unconditionally. Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1010970 Reported-and-tested-by: David Disseldorp Reviewed-by: David Disseldorp Cc: Signed-off-by: Takashi Iwai --- drivers/block/zram/zram_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c index 04365b17ee67..5163c8f918cb 100644 --- a/drivers/block/zram/zram_drv.c +++ b/drivers/block/zram/zram_drv.c @@ -1403,7 +1403,8 @@ static ssize_t hot_remove_store(struct class *class, zram = idr_find(&zram_index_idr, dev_id); if (zram) { ret = zram_remove(zram); - idr_remove(&zram_index_idr, dev_id); + if (!ret) + idr_remove(&zram_index_idr, dev_id); } else { ret = -ENODEV; } -- 2.10.2