From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Liu Bo <bo.li.liu@oracle.com>,
David Sterba <dsterba@suse.com>
Subject: [PATCH 4.15 32/52] btrfs: Fix NULL pointer exception in find_bio_stripe
Date: Mon, 19 Mar 2018 19:08:30 +0100 [thread overview]
Message-ID: <20180319180736.832491393@linuxfoundation.org> (raw)
In-Reply-To: <20180319180734.976730813@linuxfoundation.org>
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitriy Gorokh <Dmitriy.Gorokh@wdc.com>
commit 047fdea6341966a0898e3b16c51f54d4f5ba030a upstream.
On detaching of a disk which is a part of a RAID6 filesystem, the
following kernel OOPS may happen:
[63122.680461] BTRFS error (device sdo): bdev /dev/sdo errs: wr 0, rd 0, flush 1, corrupt 0, gen 0
[63122.719584] BTRFS warning (device sdo): lost page write due to IO error on /dev/sdo
[63122.719587] BTRFS error (device sdo): bdev /dev/sdo errs: wr 1, rd 0, flush 1, corrupt 0, gen 0
[63122.803516] BTRFS warning (device sdo): lost page write due to IO error on /dev/sdo
[63122.803519] BTRFS error (device sdo): bdev /dev/sdo errs: wr 2, rd 0, flush 1, corrupt 0, gen 0
[63122.863902] BTRFS critical (device sdo): fatal error on device /dev/sdo
[63122.935338] BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
[63122.946554] IP: fail_bio_stripe+0x58/0xa0 [btrfs]
[63122.958185] PGD 9ecda067 P4D 9ecda067 PUD b2b37067 PMD 0
[63122.971202] Oops: 0000 [#1] SMP
[63123.006760] CPU: 0 PID: 3979 Comm: kworker/u8:9 Tainted: G W 4.14.2-16-scst34x+ #8
[63123.007091] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[63123.007402] Workqueue: btrfs-worker btrfs_worker_helper [btrfs]
[63123.007595] task: ffff880036ea4040 task.stack: ffffc90006384000
[63123.007796] RIP: 0010:fail_bio_stripe+0x58/0xa0 [btrfs]
[63123.007968] RSP: 0018:ffffc90006387ad8 EFLAGS: 00010287
[63123.008140] RAX: 0000000000000002 RBX: ffff88004beaa0b8 RCX: ffff8800b2bd5690
[63123.008359] RDX: 0000000000000000 RSI: ffff88007bb43500 RDI: ffff88004beaa000
[63123.008621] RBP: ffffc90006387ae8 R08: 0000000099100000 R09: ffff8800b2bd5600
[63123.008840] R10: 0000000000000004 R11: 0000000000010000 R12: ffff88007bb43500
[63123.009059] R13: 00000000fffffffb R14: ffff880036fc5180 R15: 0000000000000004
[63123.009278] FS: 0000000000000000(0000) GS:ffff8800b7000000(0000) knlGS:0000000000000000
[63123.009564] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[63123.009748] CR2: 0000000000000080 CR3: 00000000b0866000 CR4: 00000000000406f0
[63123.009969] Call Trace:
[63123.010085] raid_write_end_io+0x7e/0x80 [btrfs]
[63123.010251] bio_endio+0xa1/0x120
[63123.010378] generic_make_request+0x218/0x270
[63123.010921] submit_bio+0x66/0x130
[63123.011073] finish_rmw+0x3fc/0x5b0 [btrfs]
[63123.011245] full_stripe_write+0x96/0xc0 [btrfs]
[63123.011428] raid56_parity_write+0x117/0x170 [btrfs]
[63123.011604] btrfs_map_bio+0x2ec/0x320 [btrfs]
[63123.011759] ? ___cache_free+0x1c5/0x300
[63123.011909] __btrfs_submit_bio_done+0x26/0x50 [btrfs]
[63123.012087] run_one_async_done+0x9c/0xc0 [btrfs]
[63123.012257] normal_work_helper+0x19e/0x300 [btrfs]
[63123.012429] btrfs_worker_helper+0x12/0x20 [btrfs]
[63123.012656] process_one_work+0x14d/0x350
[63123.012888] worker_thread+0x4d/0x3a0
[63123.013026] ? _raw_spin_unlock_irqrestore+0x15/0x20
[63123.013192] kthread+0x109/0x140
[63123.013315] ? process_scheduled_works+0x40/0x40
[63123.013472] ? kthread_stop+0x110/0x110
[63123.013610] ret_from_fork+0x25/0x30
[63123.014469] RIP: fail_bio_stripe+0x58/0xa0 [btrfs] RSP: ffffc90006387ad8
[63123.014678] CR2: 0000000000000080
[63123.016590] ---[ end trace a295ea7259c17880 ]—
This is reproducible in a cycle, where a series of writes is followed by
SCSI device delete command. The test may take up to few minutes.
Fixes: 74d46992e0d9 ("block: replace bi_bdev with a gendisk pointer and partitions index")
[ no signed-off-by provided ]
Author: Dmitriy Gorokh <Dmitriy.Gorokh@wdc.com>
Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/raid56.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -1351,6 +1351,7 @@ static int find_bio_stripe(struct btrfs_
stripe_start = stripe->physical;
if (physical >= stripe_start &&
physical < stripe_start + rbio->stripe_len &&
+ stripe->dev->bdev &&
bio->bi_disk == stripe->dev->bdev->bd_disk &&
bio->bi_partno == stripe->dev->bdev->bd_partno) {
return i;
next prev parent reply other threads:[~2018-03-19 18:08 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-19 18:07 [PATCH 4.15 00/52] 4.15.12-stable review Greg Kroah-Hartman
2018-03-19 18:07 ` [PATCH 4.15 01/52] x86/cpufeatures: Add Intel Total Memory Encryption cpufeature Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 02/52] x86/cpufeatures: Add Intel PCONFIG cpufeature Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 03/52] selftests/x86/entry_from_vm86: Exit with 1 if we fail Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 04/52] selftests/x86/entry_from_vm86: Add test cases for POPF Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 05/52] x86/vm86/32: Fix POPF emulation Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 06/52] x86/speculation, objtool: Annotate indirect calls/jumps for objtool on 32-bit kernels Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 07/52] x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 08/52] KVM: x86: Fix device passthrough when SME is active Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 09/52] x86/mm: Fix vmalloc_fault to use pXd_large Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 10/52] parisc: Handle case where flush_cache_range is called with no context Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 11/52] ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 12/52] ALSA: hda - Revert power_save option default value Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 13/52] ALSA: seq: Fix possible UAF in snd_seq_check_queue() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 14/52] ALSA: seq: Clear client entry before deleting else at closing Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 15/52] drm/nouveau/bl: Fix oops on driver unbind Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 16/52] drm/nouveau/mmu: ALIGN_DOWN correct variable Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 17/52] drm/amdgpu: fix prime teardown order Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 18/52] drm/radeon: " Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 19/52] drm/amdgpu/dce: Dont turn off DP sink when disconnected Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 20/52] fs: Teach path_connected to handle nfs filesystems with multiple roots Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 21/52] KVM: arm/arm64: Reduce verbosity of KVM init log Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 22/52] KVM: arm/arm64: Reset mapped IRQs on VM reset Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 23/52] kvm: arm/arm64: vgic-v3: Tighten synchronization for guests using v2 on v3 Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 24/52] KVM: arm/arm64: vgic: Dont populate multiple LRs with the same vintid Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 25/52] lock_parent() needs to recheck if dentry got __dentry_killed under it Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 26/52] fs/aio: Add explicit RCU grace period when freeing kioctx Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 27/52] fs/aio: Use RCU accessors for kioctx_table->table[] Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 28/52] RDMAVT: Fix synchronization around percpu_ref Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 29/52] irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 30/52] nvme: fix subsystem multiple controllers support check Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 31/52] xfs: preserve i_rdev when recycling a reclaimable inode Greg Kroah-Hartman
2018-03-19 18:08 ` Greg Kroah-Hartman [this message]
2018-03-19 18:08 ` [PATCH 4.15 33/52] btrfs: add missing initialization in btrfs_check_shared Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 34/52] btrfs: alloc_chunk: fix DUP stripe size handling Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 35/52] btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 36/52] btrfs: remove spurious WARN_ON(ref->count < 0) in find_parent_nodes Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 37/52] btrfs: Fix memory barriers usage with device stats counters Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 38/52] scsi: qla2xxx: Fix smatch warning in qla25xx_delete_{rsp|req}_que Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 39/52] scsi: qla2xxx: Fix NULL pointer access for fcport structure Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 40/52] scsi: qla2xxx: Fix logo flag for qlt_free_session_done() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 41/52] scsi: qla2xxx: Fix crashes in qla2x00_probe_one on probe failure Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 42/52] usb: dwc2: fix STM32F7 USB OTG HS compatible Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 43/52] dt-bindings: usb: fix the STM32F7 DWC2 OTG HS core binding Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 44/52] USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 45/52] usb: dwc3: Fix GDBGFIFOSPACE_TYPE values Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 46/52] usb: dwc3: core: Power-off core/PHYs on system_suspend in host mode Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 47/52] usb: dwc3: of-simple: fix oops by unbalanced clk disable call Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 48/52] usb: gadget: udc: renesas_usb3: fix oops in renesas_usb3_remove() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 49/52] phy: phy-brcm-usb: Fix two DT properties to match bindings doc Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 50/52] phy: phy-brcm-usb-init: Some Low Speed keyboards fail on 7271 Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 51/52] phy: phy-brcm-usb-init: DRD mode can cause crash on startup Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 52/52] phy: phy-brcm-usb-init: Power down USB 3.0 PHY when XHCI disabled Greg Kroah-Hartman
2018-03-19 23:20 ` [PATCH 4.15 00/52] 4.15.12-stable review kernelci.org bot
2018-03-20 6:47 ` Naresh Kamboju
2018-03-20 7:44 ` Greg Kroah-Hartman
2018-03-20 12:24 ` Thadeu Lima de Souza Cascardo
2018-03-21 11:07 ` Greg Kroah-Hartman
2018-03-20 16:11 ` Guenter Roeck
2018-03-21 12:29 ` Greg Kroah-Hartman
2018-03-20 20:11 ` Shuah Khan
2018-03-21 9:42 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180319180736.832491393@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=bo.li.liu@oracle.com \
--cc=dsterba@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome