From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Coly Li <colyli@suse.de>, Jens Axboe <axboe@kernel.dk>,
Sasha Levin <sashal@kernel.org>,
linux-bcache@vger.kernel.org
Subject: [PATCH AUTOSEL 4.9 64/73] bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush()
Date: Mon, 15 Jul 2019 10:36:20 -0400 [thread overview]
Message-ID: <20190715143629.10893-64-sashal@kernel.org> (raw)
In-Reply-To: <20190715143629.10893-1-sashal@kernel.org>
From: Coly Li <colyli@suse.de>
[ Upstream commit b387e9b58679c60f5b1e4313939bd4878204fc37 ]
When system memory is in heavy pressure, bch_gc_thread_start() from
run_cache_set() may fail due to out of memory. In such condition,
c->gc_thread is assigned to -ENOMEM, not NULL pointer. Then in following
failure code path bch_cache_set_error(), when cache_set_flush() gets
called, the code piece to stop c->gc_thread is broken,
if (!IS_ERR_OR_NULL(c->gc_thread))
kthread_stop(c->gc_thread);
And KASAN catches such NULL pointer deference problem, with the warning
information:
[ 561.207881] ==================================================================
[ 561.207900] BUG: KASAN: null-ptr-deref in kthread_stop+0x3b/0x440
[ 561.207904] Write of size 4 at addr 000000000000001c by task kworker/15:1/313
[ 561.207913] CPU: 15 PID: 313 Comm: kworker/15:1 Tainted: G W 5.0.0-vanilla+ #3
[ 561.207916] Hardware name: Lenovo ThinkSystem SR650 -[7X05CTO1WW]-/-[7X05CTO1WW]-, BIOS -[IVE136T-2.10]- 03/22/2019
[ 561.207935] Workqueue: events cache_set_flush [bcache]
[ 561.207940] Call Trace:
[ 561.207948] dump_stack+0x9a/0xeb
[ 561.207955] ? kthread_stop+0x3b/0x440
[ 561.207960] ? kthread_stop+0x3b/0x440
[ 561.207965] kasan_report+0x176/0x192
[ 561.207973] ? kthread_stop+0x3b/0x440
[ 561.207981] kthread_stop+0x3b/0x440
[ 561.207995] cache_set_flush+0xd4/0x6d0 [bcache]
[ 561.208008] process_one_work+0x856/0x1620
[ 561.208015] ? find_held_lock+0x39/0x1d0
[ 561.208028] ? drain_workqueue+0x380/0x380
[ 561.208048] worker_thread+0x87/0xb80
[ 561.208058] ? __kthread_parkme+0xb6/0x180
[ 561.208067] ? process_one_work+0x1620/0x1620
[ 561.208072] kthread+0x326/0x3e0
[ 561.208079] ? kthread_create_worker_on_cpu+0xc0/0xc0
[ 561.208090] ret_from_fork+0x3a/0x50
[ 561.208110] ==================================================================
[ 561.208113] Disabling lock debugging due to kernel taint
[ 561.208115] irq event stamp: 11800231
[ 561.208126] hardirqs last enabled at (11800231): [<ffffffff83008538>] do_syscall_64+0x18/0x410
[ 561.208127] BUG: unable to handle kernel NULL pointer dereference at 000000000000001c
[ 561.208129] #PF error: [WRITE]
[ 561.312253] hardirqs last disabled at (11800230): [<ffffffff830052ff>] trace_hardirqs_off_thunk+0x1a/0x1c
[ 561.312259] softirqs last enabled at (11799832): [<ffffffff850005c7>] __do_softirq+0x5c7/0x8c3
[ 561.405975] PGD 0 P4D 0
[ 561.442494] softirqs last disabled at (11799821): [<ffffffff831add2c>] irq_exit+0x1ac/0x1e0
[ 561.791359] Oops: 0002 [#1] SMP KASAN NOPTI
[ 561.791362] CPU: 15 PID: 313 Comm: kworker/15:1 Tainted: G B W 5.0.0-vanilla+ #3
[ 561.791363] Hardware name: Lenovo ThinkSystem SR650 -[7X05CTO1WW]-/-[7X05CTO1WW]-, BIOS -[IVE136T-2.10]- 03/22/2019
[ 561.791371] Workqueue: events cache_set_flush [bcache]
[ 561.791374] RIP: 0010:kthread_stop+0x3b/0x440
[ 561.791376] Code: 00 00 65 8b 05 26 d5 e0 7c 89 c0 48 0f a3 05 ec aa df 02 0f 82 dc 02 00 00 4c 8d 63 20 be 04 00 00 00 4c 89 e7 e8 65 c5 53 00 <f0> ff 43 20 48 8d 7b 24 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48
[ 561.791377] RSP: 0018:ffff88872fc8fd10 EFLAGS: 00010286
[ 561.838895] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[ 561.838916] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[ 561.838934] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[ 561.838948] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[ 561.838966] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[ 561.838979] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[ 561.838996] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[ 563.067028] RAX: 0000000000000000 RBX: fffffffffffffffc RCX: ffffffff832dd314
[ 563.067030] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000297
[ 563.067032] RBP: ffff88872fc8fe88 R08: fffffbfff0b8213d R09: fffffbfff0b8213d
[ 563.067034] R10: 0000000000000001 R11: fffffbfff0b8213c R12: 000000000000001c
[ 563.408618] R13: ffff88dc61cc0f68 R14: ffff888102b94900 R15: ffff88dc61cc0f68
[ 563.408620] FS: 0000000000000000(0000) GS:ffff888f7dc00000(0000) knlGS:0000000000000000
[ 563.408622] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 563.408623] CR2: 000000000000001c CR3: 0000000f48a1a004 CR4: 00000000007606e0
[ 563.408625] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 563.408627] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 563.904795] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[ 563.915796] PKRU: 55555554
[ 563.915797] Call Trace:
[ 563.915807] cache_set_flush+0xd4/0x6d0 [bcache]
[ 563.915812] process_one_work+0x856/0x1620
[ 564.001226] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[ 564.033563] ? find_held_lock+0x39/0x1d0
[ 564.033567] ? drain_workqueue+0x380/0x380
[ 564.033574] worker_thread+0x87/0xb80
[ 564.062823] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[ 564.118042] ? __kthread_parkme+0xb6/0x180
[ 564.118046] ? process_one_work+0x1620/0x1620
[ 564.118048] kthread+0x326/0x3e0
[ 564.118050] ? kthread_create_worker_on_cpu+0xc0/0xc0
[ 564.167066] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[ 564.252441] ret_from_fork+0x3a/0x50
[ 564.252447] Modules linked in: msr rpcrdma sunrpc rdma_ucm ib_iser ib_umad rdma_cm ib_ipoib i40iw configfs iw_cm ib_cm libiscsi scsi_transport_iscsi mlx4_ib ib_uverbs mlx4_en ib_core nls_iso8859_1 nls_cp437 vfat fat intel_rapl skx_edac x86_pkg_temp_thermal coretemp iTCO_wdt iTCO_vendor_support crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel ses raid0 aesni_intel cdc_ether enclosure usbnet ipmi_ssif joydev aes_x86_64 i40e scsi_transport_sas mii bcache md_mod crypto_simd mei_me ioatdma crc64 ptp cryptd pcspkr i2c_i801 mlx4_core glue_helper pps_core mei lpc_ich dca wmi ipmi_si ipmi_devintf nd_pmem dax_pmem nd_btt ipmi_msghandler device_dax pcc_cpufreq button hid_generic usbhid mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect xhci_pci sysimgblt fb_sys_fops xhci_hcd ttm megaraid_sas drm usbcore nfit libnvdimm sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua efivarfs
[ 564.299390] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[ 564.348360] CR2: 000000000000001c
[ 564.348362] ---[ end trace b7f0e5cc7b2103b0 ]---
Therefore, it is not enough to only check whether c->gc_thread is NULL,
we should use IS_ERR_OR_NULL() to check both NULL pointer and error
value.
This patch changes the above buggy code piece in this way,
if (!IS_ERR_OR_NULL(c->gc_thread))
kthread_stop(c->gc_thread);
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/bcache/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 9f2588eaaf5f..c5bc3e5e921e 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1405,7 +1405,7 @@ static void cache_set_flush(struct closure *cl)
kobject_put(&c->internal);
kobject_del(&c->kobj);
- if (c->gc_thread)
+ if (!IS_ERR_OR_NULL(c->gc_thread))
kthread_stop(c->gc_thread);
if (!IS_ERR_OR_NULL(c->root))
--
2.20.1
next prev parent reply other threads:[~2019-07-15 14:40 UTC|newest]
Thread overview: 73+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-15 14:35 [PATCH AUTOSEL 4.9 01/73] ath10k: Do not send probe response template for mesh Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 02/73] ath9k: Check for errors when reading SREV register Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 03/73] ath6kl: add some bounds checking Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 04/73] ath: DFS JP domain W56 fixed pulse type 3 RADAR detection Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 05/73] batman-adv: fix for leaked TVLV handler Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 06/73] media: dvb: usb: fix use after free in dvb_usb_device_exit Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 07/73] crypto: talitos - fix skcipher failure due to wrong output IV Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 08/73] media: marvell-ccic: fix DMA s/g desc number calculation Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 09/73] media: vpss: fix a potential NULL pointer dereference Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 10/73] media: media_device_enum_links32: clean a reserved field Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 11/73] net: stmmac: dwmac1000: Clear unused address entries Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 12/73] net: stmmac: dwmac4/5: " Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 13/73] signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 14/73] signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 15/73] af_key: fix leaks in key_pol_get_resp and dump_sp Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 16/73] xfrm: Fix xfrm sel prefix length validation Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 17/73] Revert "e1000e: fix cyclic resets at link up with active tx" Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 18/73] e1000e: start network tx queue only when link is up Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 19/73] media: mc-device.c: don't memset __user pointer contents Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 20/73] media: staging: media: davinci_vpfe: - Fix for memory leak if decoder initialization fails Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 21/73] net: phy: Check against net_device being NULL Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 22/73] crypto: talitos - properly handle split ICV Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 23/73] crypto: talitos - Align SEC1 accesses to 32 bits boundaries Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 24/73] tua6100: Avoid build warnings Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 25/73] locking/lockdep: Fix merging of hlocks with non-zero references Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 26/73] media: wl128x: Fix some error handling in fm_v4l2_init_video_device() Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 27/73] cpupower : frequency-set -r option misses the last cpu in related cpu list Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 28/73] net: fec: Do not use netdev messages too early Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 29/73] net: axienet: Fix race condition causing TX hang Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 30/73] s390/qdio: handle PENDING state for QEBSM devices Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 31/73] perf cs-etm: Properly set the value of 'old' and 'head' in snapshot mode Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 32/73] perf test 6: Fix missing kvm module load for s390 Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 33/73] gpio: omap: fix lack of irqstatus_raw0 for OMAP4 Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 34/73] gpio: omap: ensure irq is enabled before wakeup Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 35/73] regmap: fix bulk writes on paged registers Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 36/73] bpf: silence warning messages in core Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 37/73] rcu: Force inlining of rcu_read_lock() Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 38/73] blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership arbitration Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 39/73] xfrm: fix sa selector validation Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 40/73] perf evsel: Make perf_evsel__name() accept a NULL argument Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 41/73] vhost_net: disable zerocopy by default Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 42/73] ipoib: correcly show a VF hardware address Sasha Levin
2019-07-15 14:35 ` [PATCH AUTOSEL 4.9 43/73] EDAC/sysfs: Fix memory leak when creating a csrow object Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 44/73] ipsec: select crypto ciphers for xfrm_algo Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 45/73] media: i2c: fix warning same module names Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 46/73] ntp: Limit TAI-UTC offset Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 47/73] timer_list: Guard procfs specific code Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 48/73] acpi/arm64: ignore 5.1 FADTs that are reported as 5.0 Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 49/73] media: coda: fix mpeg2 sequence number handling Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 50/73] media: coda: increment sequence offset for the last returned frame Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 51/73] mt7601u: do not schedule rx_tasklet when the device has been disconnected Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 52/73] x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 53/73] mt7601u: fix possible memory leak when the device is disconnected Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 54/73] ath10k: fix PCIE device wake up failed Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 55/73] perf tools: Increase MAX_NR_CPUS and MAX_CACHES Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 56/73] libata: don't request sense data on !ZAC ATA devices Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 57/73] clocksource/drivers/exynos_mct: Increase priority over ARM arch timer Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 58/73] rslib: Fix decoding of shortened codes Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 59/73] rslib: Fix handling of of caller provided syndrome Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 60/73] ixgbe: Check DDM existence in transceiver before access Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 61/73] crypto: asymmetric_keys - select CRYPTO_HASH where needed Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 62/73] PCI / ACPI: Use cached ACPI device state to get PCI device power state Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 63/73] EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec Sasha Levin
2019-07-15 14:36 ` Sasha Levin [this message]
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 65/73] iwlwifi: mvm: Drop large non sta frames Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 66/73] net: usb: asix: init MAC address buffers Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 67/73] gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 68/73] Bluetooth: hci_bcsp: Fix memory leak in rx_skb Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 69/73] Bluetooth: 6lowpan: search for destination address in all peers Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 70/73] Bluetooth: Check state in l2cap_disconnect_rsp Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 71/73] Bluetooth: validate BLE connection interval updates Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 72/73] gtp: fix Illegal context switch in RCU read-side critical section Sasha Levin
2019-07-15 14:36 ` [PATCH AUTOSEL 4.9 73/73] gtp: fix use-after-free in gtp_newlink() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190715143629.10893-64-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=axboe@kernel.dk \
--cc=colyli@suse.de \
--cc=linux-bcache@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®