block: tolerate 0 byte discard_granularity in __blkdev_issue_discard()
diff mbox series

Message ID 20200804142332.29961-1-colyli@suse.de
State New
Headers show
Series
  • block: tolerate 0 byte discard_granularity in __blkdev_issue_discard()
Related show

Commit Message

Coly Li Aug. 4, 2020, 2:23 p.m. UTC
When some buggy driver doesn't set its queue->limits.discard_granularity
(e.g. current loop device driver), discard at LBA 0 on such device will
trigger a kernel BUG() panic from block/blk-mq.c:563.

[  955.565006][   C39] ------------[ cut here ]------------
[  955.559660][   C39] invalid opcode: 0000 [#1] SMP NOPTI
[  955.622171][   C39] CPU: 39 PID: 248 Comm: ksoftirqd/39 Tainted: G            E     5.8.0-default+ #40
[  955.622171][   C39] Hardware name: Lenovo ThinkSystem SR650 -[7X05CTO1WW]-/-[7X05CTO1WW]-, BIOS -[IVE160M-2.70]- 07/17/2020
[  955.622175][   C39] RIP: 0010:blk_mq_end_request+0x107/0x110
[  955.622177][   C39] Code: 48 8b 03 e9 59 ff ff ff 48 89 df 5b 5d 41 5c e9 9f ed ff ff 48 8b 35 98 3c f4 00 48 83 c7 10 48 83 c6 19 e8 cb 56 c9 ff eb cb <0f> 0b 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 54
[  955.622179][   C39] RSP: 0018:ffffb1288701fe28 EFLAGS: 00010202
[  955.749277][   C39] RAX: 0000000000000001 RBX: ffff956fffba5080 RCX: 0000000000004003
[  955.749278][   C39] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000000
[  955.749279][   C39] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  955.749279][   C39] R10: ffffb1288701fd28 R11: 0000000000000001 R12: ffffffffa8e05160
[  955.749280][   C39] R13: 0000000000000004 R14: 0000000000000004 R15: ffffffffa7ad3a1e
[  955.749281][   C39] FS:  0000000000000000(0000) GS:ffff95bfbda00000(0000) knlGS:0000000000000000
[  955.749282][   C39] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  955.749282][   C39] CR2: 00007f6f0ef766a8 CR3: 0000005a37012002 CR4: 00000000007606e0
[  955.749283][   C39] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  955.749284][   C39] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  955.749284][   C39] PKRU: 55555554
[  955.749285][   C39] Call Trace:
[  955.749290][   C39]  blk_done_softirq+0x99/0xc0
[  957.550669][   C39]  __do_softirq+0xd3/0x45f
[  957.550677][   C39]  ? smpboot_thread_fn+0x2f/0x1e0
[  957.550679][   C39]  ? smpboot_thread_fn+0x74/0x1e0
[  957.550680][   C39]  ? smpboot_thread_fn+0x14e/0x1e0
[  957.550684][   C39]  run_ksoftirqd+0x30/0x60
[  957.550687][   C39]  smpboot_thread_fn+0x149/0x1e0
[  957.886225][   C39]  ? sort_range+0x20/0x20
[  957.886226][   C39]  kthread+0x137/0x160
[  957.886228][   C39]  ? kthread_park+0x90/0x90
[  957.886231][   C39]  ret_from_fork+0x22/0x30
[  959.117120][   C39] ---[ end trace 3dacdac97e2ed164 ]---

This is the procedure to reproduce the panic,
  # modprobe scsi_debug delay=0 dev_size_mb=2048 max_queue=1
  # losetup -f /dev/nvme0n1 --direct-io=on
  # blkdiscard /dev/loop0 -o 0 -l 0x200

This is how the BUG() panic triggered by __blkdev_issue_discard(),
- For a NVMe SSD backing loop device, the driver does not initialize
  its queue->limits.discard_granularity and leaves it to 0.
- When discard on LBA 0 of the loop device, __blkdev_issue_discard()
  is called before loop device driver code.
- Inside __blkdev_issue_discard(), when calculating value of
  granularity_aligned_lba by
	granularity_aligned_lba = round_up(sector_mapped,
			q->limits.discard_granularity >> SECTOR_SHIFT);
  because sector_mapped is 0 (at LBA 0 and no partition offset), and
  q->limits.discard_granularity is 0 (by the buggy loop driver), the
  calculated granularity_aligned_lba is 0.
- The inline function bio_aligned_discard_max_sectors() is defined as
	return round_down(UINT_MAX, q->limits.discard_granularity) >>
			SECTOR_SHIFT;
   when q->limits.discard_granularity is 0 from loop device driver, the
   above calculation returns value 0.
- Now granularity_aligned_lba and sctor_mapped are 0, req_sectors is
  calculated by the following lines in __blkdev_issue_discard(),
	if (granularity_aligned_lba == sector_mapped)
		req_sects = min_t(sector_t, nr_sects,
				  bio_aligned_discard_max_sectors(q));
  because bio_aligned_discard_max_sectors(q) returns 0, req_sects is
  calculated as 0.
- Now a discard bio is mistakenly initialized as a 0 byte bio by,
	bio->bi_iter.bi_size = req_sects << 9;
  and sent to loop device driver.
- This discard request is handled by loop device driver by following
  code path,
    loop_handle_cmd => do_req_filebacked => lo_fallocate =>
    file->f_op->fallocate => blkdev_fallocate => blkdev_issue_zeroout =>
    __blkdev_issue_write_zeroes
- Inside __blkdev_issue_write_zeroes(), a 0 byte length discard bio is
  composed and sent to the backing device of the loop device.
- In the I/O completion code path, in my case it is,
    blk_done_softirq => nrq->q->mq_ops->complete => nvme_pci_complete_rq
    => nvme_complete_rq => blk_mq_end_request
  inside blk_mq_end_request(), blk_update_request() is called and due to
  req->bio is NULL in previous step, blk_update_request() returns false
  then the BUG() panic in blk_mq_end_request() is triggered.

Although the above panic can be fixed in loop device driver, the generic
__blkdev_issue_discard() should also be fixed to tolerate the incorrect
0 value from queue->limits.discard_granularity, in case some other buggy
driver makes such mistake again.

This patch checks whether q->limits.discard_granularity is 0 in
__blkdev_issue_discard() and bio_aligned_discard_max_sectors(). If it is
0 from some buggy driver queue, prints a warning oops information and
set queue_logical_block_size(q) to a local variable discard_granularity.
This local variable is used in round_up() and round_down() calculation,
now req_sects won't be 0  and no empty discard request is generated.

Fixes: 9b15d109a6b2 ("block: improve discard bio alignment in __blkdev_issue_discard()")
Fixes: c52abf563049 ("loop: Better discard support for block devices")
Reported-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Coly Li <colyli@suse.de>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Xiao Ni <xni@redhat.com>
Cc: Bart Van Assche <bvanassche@acm.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Enzo Matsumiya <ematsumiya@suse.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Evan Green <evgreen@chromium.org>
---
 block/blk-lib.c | 8 +++++++-
 block/blk.h     | 9 +++++++--
 2 files changed, 14 insertions(+), 3 deletions(-)

Comments

Johannes Thumshirn Aug. 4, 2020, 2:31 p.m. UTC | #1
On 04/08/2020 16:23, Coly Li wrote:
> This is the procedure to reproduce the panic,
>   # modprobe scsi_debug delay=0 dev_size_mb=2048 max_queue=1
>   # losetup -f /dev/nvme0n1 --direct-io=on
>   # blkdiscard /dev/loop0 -o 0 -l 0x200

losetup -f /dev/sdX isn't it?
Coly Li Aug. 4, 2020, 2:34 p.m. UTC | #2
On 2020/8/4 22:31, Johannes Thumshirn wrote:
> On 04/08/2020 16:23, Coly Li wrote:
>> This is the procedure to reproduce the panic,
>>   # modprobe scsi_debug delay=0 dev_size_mb=2048 max_queue=1
>>   # losetup -f /dev/nvme0n1 --direct-io=on
>>   # blkdiscard /dev/loop0 -o 0 -l 0x200
> 
> losetup -f /dev/sdX isn't it?
> 

In my case, I use a NVMe SSD as the backing device of the loop device.
Because I don't have a scsi lun.

And loading scsi_debug module seems necessary, otherwise the discard
process just hang and I cannot see the kernel panic (I don't know why yet).

Coly Li
Johannes Thumshirn Aug. 4, 2020, 2:37 p.m. UTC | #3
On 04/08/2020 16:34, Coly Li wrote:
> On 2020/8/4 22:31, Johannes Thumshirn wrote:
>> On 04/08/2020 16:23, Coly Li wrote:
>>> This is the procedure to reproduce the panic,
>>>   # modprobe scsi_debug delay=0 dev_size_mb=2048 max_queue=1
>>>   # losetup -f /dev/nvme0n1 --direct-io=on
>>>   # blkdiscard /dev/loop0 -o 0 -l 0x200
>>
>> losetup -f /dev/sdX isn't it?
>>
> 
> In my case, I use a NVMe SSD as the backing device of the loop device.
> Because I don't have a scsi lun.
> 
> And loading scsi_debug module seems necessary, otherwise the discard
> process just hang and I cannot see the kernel panic (I don't know why yet).

OK, now that's highly interesting. Does it also happen if you back loop with
a file? loop_config_discard() has different cases for the different backing devices/files. S
Johannes Thumshirn Aug. 4, 2020, 2:39 p.m. UTC | #4
On 04/08/2020 16:37, Johannes Thumshirn wrote:
> On 04/08/2020 16:34, Coly Li wrote:
>> On 2020/8/4 22:31, Johannes Thumshirn wrote:
>>> On 04/08/2020 16:23, Coly Li wrote:
>>>> This is the procedure to reproduce the panic,
>>>>   # modprobe scsi_debug delay=0 dev_size_mb=2048 max_queue=1
>>>>   # losetup -f /dev/nvme0n1 --direct-io=on
>>>>   # blkdiscard /dev/loop0 -o 0 -l 0x200
>>>
>>> losetup -f /dev/sdX isn't it?
>>>
>>
>> In my case, I use a NVMe SSD as the backing device of the loop device.
>> Because I don't have a scsi lun.
>>
>> And loading scsi_debug module seems necessary, otherwise the discard
>> process just hang and I cannot see the kernel panic (I don't know why yet).
> 
> OK, now that's highly interesting. Does it also happen if you back loop with
> a file? loop_config_discard() has different cases for the different backing devices/files. S
> 

Damn I didn't want to hit sent....

Does this (untested) change make a difference:

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 475e1a738560..8a07a89d702e 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -895,6 +895,9 @@ static void loop_config_discard(struct loop_device *lo)
                blk_queue_max_write_zeroes_sectors(q,
                        backingq->limits.max_write_zeroes_sectors);
 
+               q->limits.discard_granularity =
+                       backingq->limits.discard_granularity;
+
        /*
         * We use punch hole to reclaim the free space used by the
         * image a.k.a. discard. However we do not support discard if
Coly Li Aug. 4, 2020, 2:43 p.m. UTC | #5
On 2020/8/4 22:37, Johannes Thumshirn wrote:
> On 04/08/2020 16:34, Coly Li wrote:
>> On 2020/8/4 22:31, Johannes Thumshirn wrote:
>>> On 04/08/2020 16:23, Coly Li wrote:
>>>> This is the procedure to reproduce the panic,
>>>>   # modprobe scsi_debug delay=0 dev_size_mb=2048 max_queue=1
>>>>   # losetup -f /dev/nvme0n1 --direct-io=on
>>>>   # blkdiscard /dev/loop0 -o 0 -l 0x200
>>>
>>> losetup -f /dev/sdX isn't it?
>>>
>>
>> In my case, I use a NVMe SSD as the backing device of the loop device.
>> Because I don't have a scsi lun.
>>
>> And loading scsi_debug module seems necessary, otherwise the discard
>> process just hang and I cannot see the kernel panic (I don't know why yet).
> 
> OK, now that's highly interesting. Does it also happen if you back loop with
> a file? loop_config_discard() has different cases for the different backing devices/files. S
> 
No, for a file backing, q->limits.discard_granularity is set to
inode->i_sb->s_blocksize. And the encrypted loop device does not support
discard.

Such issue just only happens on a device backing loop device which
announces supporting discard. Without Ming's fix to loop device driver,
discard on LBA 0 will trigger the BUG() panic in my setup (Maybe it is
more easier to trigger this BUG() panic with scsi lun).

Coly Li
Coly Li Aug. 4, 2020, 2:45 p.m. UTC | #6
On 2020/8/4 22:39, Johannes Thumshirn wrote:
> On 04/08/2020 16:37, Johannes Thumshirn wrote:
>> On 04/08/2020 16:34, Coly Li wrote:
>>> On 2020/8/4 22:31, Johannes Thumshirn wrote:
>>>> On 04/08/2020 16:23, Coly Li wrote:
>>>>> This is the procedure to reproduce the panic,
>>>>>   # modprobe scsi_debug delay=0 dev_size_mb=2048 max_queue=1
>>>>>   # losetup -f /dev/nvme0n1 --direct-io=on
>>>>>   # blkdiscard /dev/loop0 -o 0 -l 0x200
>>>>
>>>> losetup -f /dev/sdX isn't it?
>>>>
>>>
>>> In my case, I use a NVMe SSD as the backing device of the loop device.
>>> Because I don't have a scsi lun.
>>>
>>> And loading scsi_debug module seems necessary, otherwise the discard
>>> process just hang and I cannot see the kernel panic (I don't know why yet).
>>
>> OK, now that's highly interesting. Does it also happen if you back loop with
>> a file? loop_config_discard() has different cases for the different backing devices/files. S
>>
> 
> Damn I didn't want to hit sent....
> 
> Does this (untested) change make a difference:
> 
> diff --git a/drivers/block/loop.c b/drivers/block/loop.c
> index 475e1a738560..8a07a89d702e 100644
> --- a/drivers/block/loop.c
> +++ b/drivers/block/loop.c
> @@ -895,6 +895,9 @@ static void loop_config_discard(struct loop_device *lo)
>                 blk_queue_max_write_zeroes_sectors(q,
>                         backingq->limits.max_write_zeroes_sectors);
>  
> +               q->limits.discard_granularity =
> +                       backingq->limits.discard_granularity;
> +
>         /*
>          * We use punch hole to reclaim the free space used by the
>          * image a.k.a. discard. However we do not support discard if
> 

Yes, Ming just posts a patch with a very similar change to loop device
driver.

Coly Li
Johannes Thumshirn Aug. 4, 2020, 2:54 p.m. UTC | #7
On 04/08/2020 16:45, Coly Li wrote:
> Yes, Ming just posts a patch with a very similar change to loop device
> driver.

Ah ok. I'll go and have a look at Ming's patch then.
Ming Lei Aug. 4, 2020, 11:58 p.m. UTC | #8
On Tue, Aug 04, 2020 at 10:23:32PM +0800, Coly Li wrote:
> When some buggy driver doesn't set its queue->limits.discard_granularity
> (e.g. current loop device driver), discard at LBA 0 on such device will
> trigger a kernel BUG() panic from block/blk-mq.c:563.
> 
> [  955.565006][   C39] ------------[ cut here ]------------
> [  955.559660][   C39] invalid opcode: 0000 [#1] SMP NOPTI
> [  955.622171][   C39] CPU: 39 PID: 248 Comm: ksoftirqd/39 Tainted: G            E     5.8.0-default+ #40
> [  955.622171][   C39] Hardware name: Lenovo ThinkSystem SR650 -[7X05CTO1WW]-/-[7X05CTO1WW]-, BIOS -[IVE160M-2.70]- 07/17/2020
> [  955.622175][   C39] RIP: 0010:blk_mq_end_request+0x107/0x110
> [  955.622177][   C39] Code: 48 8b 03 e9 59 ff ff ff 48 89 df 5b 5d 41 5c e9 9f ed ff ff 48 8b 35 98 3c f4 00 48 83 c7 10 48 83 c6 19 e8 cb 56 c9 ff eb cb <0f> 0b 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 54
> [  955.622179][   C39] RSP: 0018:ffffb1288701fe28 EFLAGS: 00010202
> [  955.749277][   C39] RAX: 0000000000000001 RBX: ffff956fffba5080 RCX: 0000000000004003
> [  955.749278][   C39] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000000
> [  955.749279][   C39] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
> [  955.749279][   C39] R10: ffffb1288701fd28 R11: 0000000000000001 R12: ffffffffa8e05160
> [  955.749280][   C39] R13: 0000000000000004 R14: 0000000000000004 R15: ffffffffa7ad3a1e
> [  955.749281][   C39] FS:  0000000000000000(0000) GS:ffff95bfbda00000(0000) knlGS:0000000000000000
> [  955.749282][   C39] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  955.749282][   C39] CR2: 00007f6f0ef766a8 CR3: 0000005a37012002 CR4: 00000000007606e0
> [  955.749283][   C39] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [  955.749284][   C39] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [  955.749284][   C39] PKRU: 55555554
> [  955.749285][   C39] Call Trace:
> [  955.749290][   C39]  blk_done_softirq+0x99/0xc0
> [  957.550669][   C39]  __do_softirq+0xd3/0x45f
> [  957.550677][   C39]  ? smpboot_thread_fn+0x2f/0x1e0
> [  957.550679][   C39]  ? smpboot_thread_fn+0x74/0x1e0
> [  957.550680][   C39]  ? smpboot_thread_fn+0x14e/0x1e0
> [  957.550684][   C39]  run_ksoftirqd+0x30/0x60
> [  957.550687][   C39]  smpboot_thread_fn+0x149/0x1e0
> [  957.886225][   C39]  ? sort_range+0x20/0x20
> [  957.886226][   C39]  kthread+0x137/0x160
> [  957.886228][   C39]  ? kthread_park+0x90/0x90
> [  957.886231][   C39]  ret_from_fork+0x22/0x30
> [  959.117120][   C39] ---[ end trace 3dacdac97e2ed164 ]---
> 
> This is the procedure to reproduce the panic,
>   # modprobe scsi_debug delay=0 dev_size_mb=2048 max_queue=1
>   # losetup -f /dev/nvme0n1 --direct-io=on
>   # blkdiscard /dev/loop0 -o 0 -l 0x200
> 
> This is how the BUG() panic triggered by __blkdev_issue_discard(),
> - For a NVMe SSD backing loop device, the driver does not initialize
>   its queue->limits.discard_granularity and leaves it to 0.
> - When discard on LBA 0 of the loop device, __blkdev_issue_discard()
>   is called before loop device driver code.
> - Inside __blkdev_issue_discard(), when calculating value of
>   granularity_aligned_lba by
> 	granularity_aligned_lba = round_up(sector_mapped,
> 			q->limits.discard_granularity >> SECTOR_SHIFT);
>   because sector_mapped is 0 (at LBA 0 and no partition offset), and
>   q->limits.discard_granularity is 0 (by the buggy loop driver), the
>   calculated granularity_aligned_lba is 0.
> - The inline function bio_aligned_discard_max_sectors() is defined as
> 	return round_down(UINT_MAX, q->limits.discard_granularity) >>
> 			SECTOR_SHIFT;
>    when q->limits.discard_granularity is 0 from loop device driver, the
>    above calculation returns value 0.
> - Now granularity_aligned_lba and sctor_mapped are 0, req_sectors is
>   calculated by the following lines in __blkdev_issue_discard(),
> 	if (granularity_aligned_lba == sector_mapped)
> 		req_sects = min_t(sector_t, nr_sects,
> 				  bio_aligned_discard_max_sectors(q));
>   because bio_aligned_discard_max_sectors(q) returns 0, req_sects is
>   calculated as 0.
> - Now a discard bio is mistakenly initialized as a 0 byte bio by,
> 	bio->bi_iter.bi_size = req_sects << 9;
>   and sent to loop device driver.
> - This discard request is handled by loop device driver by following
>   code path,
>     loop_handle_cmd => do_req_filebacked => lo_fallocate =>
>     file->f_op->fallocate => blkdev_fallocate => blkdev_issue_zeroout =>
>     __blkdev_issue_write_zeroes
> - Inside __blkdev_issue_write_zeroes(), a 0 byte length discard bio is
>   composed and sent to the backing device of the loop device.
> - In the I/O completion code path, in my case it is,
>     blk_done_softirq => nrq->q->mq_ops->complete => nvme_pci_complete_rq
>     => nvme_complete_rq => blk_mq_end_request
>   inside blk_mq_end_request(), blk_update_request() is called and due to
>   req->bio is NULL in previous step, blk_update_request() returns false
>   then the BUG() panic in blk_mq_end_request() is triggered.
> 
> Although the above panic can be fixed in loop device driver, the generic
> __blkdev_issue_discard() should also be fixed to tolerate the incorrect
> 0 value from queue->limits.discard_granularity, in case some other buggy
> driver makes such mistake again.
> 
> This patch checks whether q->limits.discard_granularity is 0 in
> __blkdev_issue_discard() and bio_aligned_discard_max_sectors(). If it is
> 0 from some buggy driver queue, prints a warning oops information and
> set queue_logical_block_size(q) to a local variable discard_granularity.
> This local variable is used in round_up() and round_down() calculation,
> now req_sects won't be 0  and no empty discard request is generated.
> 
> Fixes: 9b15d109a6b2 ("block: improve discard bio alignment in __blkdev_issue_discard()")
> Fixes: c52abf563049 ("loop: Better discard support for block devices")
> Reported-by: Ming Lei <ming.lei@redhat.com>
> Signed-off-by: Coly Li <colyli@suse.de>
> Cc: Hannes Reinecke <hare@suse.com>
> Cc: Ming Lei <ming.lei@redhat.com>
> Cc: Xiao Ni <xni@redhat.com>
> Cc: Bart Van Assche <bvanassche@acm.org>
> Cc: Christoph Hellwig <hch@lst.de>
> Cc: Enzo Matsumiya <ematsumiya@suse.com>
> Cc: Jens Axboe <axboe@kernel.dk>
> Cc: Evan Green <evgreen@chromium.org>
> ---
>  block/blk-lib.c | 8 +++++++-
>  block/blk.h     | 9 +++++++--
>  2 files changed, 14 insertions(+), 3 deletions(-)
> 
> diff --git a/block/blk-lib.c b/block/blk-lib.c
> index 019e09bb9c0e..3017e4cba923 100644
> --- a/block/blk-lib.c
> +++ b/block/blk-lib.c
> @@ -30,6 +30,7 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
>  	struct bio *bio = *biop;
>  	unsigned int op;
>  	sector_t bs_mask, part_offset = 0;
> +	sector_t discard_granularity;
>  
>  	if (!q)
>  		return -ENXIO;
> @@ -54,6 +55,11 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
>  	if (!nr_sects)
>  		return -EINVAL;
>  
> +	discard_granularity = q->limits.discard_granularity;
> +	/* In case some buggy driver does not set limits.discard_granularity */
> +	if (WARN_ON_ONCE(discard_granularity == 0))
> +		discard_granularity = queue_logical_block_size(q);

This code path is supposed to not run in case of zero q->limits.discard_granularity,
and looks it is fine to just warn and return -EINVAL in this case,
see Documentation/ABI/testing/sysfs-block:

	What:       /sys/block/<disk>/queue/discard_granularity
	Date:       May 2011
	Contact:    Martin K. Petersen <martin.petersen@oracle.com>
	Description:
	        Devices that support discard functionality may
	        internally allocate space using units that are bigger
	        than the logical block size. The discard_granularity
	        parameter indicates the size of the internal allocation
	        unit in bytes if reported by the device. Otherwise the
	        discard_granularity will be set to match the device's
	        physical block size. A discard_granularity of 0 means
	        that the device does not support discard functionality.

What we need to fix is loop driver, if it claims to support discard,
q->limits.discard_granularity has to be one valid value.


Thanks,
Ming
Martin K. Petersen Aug. 5, 2020, 12:28 a.m. UTC | #9
Ming,

> What we need to fix is loop driver, if it claims to support discard,
> q->limits.discard_granularity has to be one valid value.

Yep!
Coly Li Aug. 5, 2020, 1:54 a.m. UTC | #10
On 2020/8/5 07:58, Ming Lei wrote:
> On Tue, Aug 04, 2020 at 10:23:32PM +0800, Coly Li wrote:
>> When some buggy driver doesn't set its queue->limits.discard_granularity
>> (e.g. current loop device driver), discard at LBA 0 on such device will
>> trigger a kernel BUG() panic from block/blk-mq.c:563.
>>
>> [  955.565006][   C39] ------------[ cut here ]------------
>> [  955.559660][   C39] invalid opcode: 0000 [#1] SMP NOPTI
>> [  955.622171][   C39] CPU: 39 PID: 248 Comm: ksoftirqd/39 Tainted: G            E     5.8.0-default+ #40
>> [  955.622171][   C39] Hardware name: Lenovo ThinkSystem SR650 -[7X05CTO1WW]-/-[7X05CTO1WW]-, BIOS -[IVE160M-2.70]- 07/17/2020
>> [  955.622175][   C39] RIP: 0010:blk_mq_end_request+0x107/0x110
>> [  955.622177][   C39] Code: 48 8b 03 e9 59 ff ff ff 48 89 df 5b 5d 41 5c e9 9f ed ff ff 48 8b 35 98 3c f4 00 48 83 c7 10 48 83 c6 19 e8 cb 56 c9 ff eb cb <0f> 0b 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 54
>> [  955.622179][   C39] RSP: 0018:ffffb1288701fe28 EFLAGS: 00010202
>> [  955.749277][   C39] RAX: 0000000000000001 RBX: ffff956fffba5080 RCX: 0000000000004003
>> [  955.749278][   C39] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000000
>> [  955.749279][   C39] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
>> [  955.749279][   C39] R10: ffffb1288701fd28 R11: 0000000000000001 R12: ffffffffa8e05160
>> [  955.749280][   C39] R13: 0000000000000004 R14: 0000000000000004 R15: ffffffffa7ad3a1e
>> [  955.749281][   C39] FS:  0000000000000000(0000) GS:ffff95bfbda00000(0000) knlGS:0000000000000000
>> [  955.749282][   C39] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [  955.749282][   C39] CR2: 00007f6f0ef766a8 CR3: 0000005a37012002 CR4: 00000000007606e0
>> [  955.749283][   C39] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> [  955.749284][   C39] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>> [  955.749284][   C39] PKRU: 55555554
>> [  955.749285][   C39] Call Trace:
>> [  955.749290][   C39]  blk_done_softirq+0x99/0xc0
>> [  957.550669][   C39]  __do_softirq+0xd3/0x45f
>> [  957.550677][   C39]  ? smpboot_thread_fn+0x2f/0x1e0
>> [  957.550679][   C39]  ? smpboot_thread_fn+0x74/0x1e0
>> [  957.550680][   C39]  ? smpboot_thread_fn+0x14e/0x1e0
>> [  957.550684][   C39]  run_ksoftirqd+0x30/0x60
>> [  957.550687][   C39]  smpboot_thread_fn+0x149/0x1e0
>> [  957.886225][   C39]  ? sort_range+0x20/0x20
>> [  957.886226][   C39]  kthread+0x137/0x160
>> [  957.886228][   C39]  ? kthread_park+0x90/0x90
>> [  957.886231][   C39]  ret_from_fork+0x22/0x30
>> [  959.117120][   C39] ---[ end trace 3dacdac97e2ed164 ]---
>>
>> This is the procedure to reproduce the panic,
>>   # modprobe scsi_debug delay=0 dev_size_mb=2048 max_queue=1
>>   # losetup -f /dev/nvme0n1 --direct-io=on
>>   # blkdiscard /dev/loop0 -o 0 -l 0x200
>>
>> This is how the BUG() panic triggered by __blkdev_issue_discard(),
>> - For a NVMe SSD backing loop device, the driver does not initialize
>>   its queue->limits.discard_granularity and leaves it to 0.
>> - When discard on LBA 0 of the loop device, __blkdev_issue_discard()
>>   is called before loop device driver code.
>> - Inside __blkdev_issue_discard(), when calculating value of
>>   granularity_aligned_lba by
>> 	granularity_aligned_lba = round_up(sector_mapped,
>> 			q->limits.discard_granularity >> SECTOR_SHIFT);
>>   because sector_mapped is 0 (at LBA 0 and no partition offset), and
>>   q->limits.discard_granularity is 0 (by the buggy loop driver), the
>>   calculated granularity_aligned_lba is 0.
>> - The inline function bio_aligned_discard_max_sectors() is defined as
>> 	return round_down(UINT_MAX, q->limits.discard_granularity) >>
>> 			SECTOR_SHIFT;
>>    when q->limits.discard_granularity is 0 from loop device driver, the
>>    above calculation returns value 0.
>> - Now granularity_aligned_lba and sctor_mapped are 0, req_sectors is
>>   calculated by the following lines in __blkdev_issue_discard(),
>> 	if (granularity_aligned_lba == sector_mapped)
>> 		req_sects = min_t(sector_t, nr_sects,
>> 				  bio_aligned_discard_max_sectors(q));
>>   because bio_aligned_discard_max_sectors(q) returns 0, req_sects is
>>   calculated as 0.
>> - Now a discard bio is mistakenly initialized as a 0 byte bio by,
>> 	bio->bi_iter.bi_size = req_sects << 9;
>>   and sent to loop device driver.
>> - This discard request is handled by loop device driver by following
>>   code path,
>>     loop_handle_cmd => do_req_filebacked => lo_fallocate =>
>>     file->f_op->fallocate => blkdev_fallocate => blkdev_issue_zeroout =>
>>     __blkdev_issue_write_zeroes
>> - Inside __blkdev_issue_write_zeroes(), a 0 byte length discard bio is
>>   composed and sent to the backing device of the loop device.
>> - In the I/O completion code path, in my case it is,
>>     blk_done_softirq => nrq->q->mq_ops->complete => nvme_pci_complete_rq
>>     => nvme_complete_rq => blk_mq_end_request
>>   inside blk_mq_end_request(), blk_update_request() is called and due to
>>   req->bio is NULL in previous step, blk_update_request() returns false
>>   then the BUG() panic in blk_mq_end_request() is triggered.
>>
>> Although the above panic can be fixed in loop device driver, the generic
>> __blkdev_issue_discard() should also be fixed to tolerate the incorrect
>> 0 value from queue->limits.discard_granularity, in case some other buggy
>> driver makes such mistake again.
>>
>> This patch checks whether q->limits.discard_granularity is 0 in
>> __blkdev_issue_discard() and bio_aligned_discard_max_sectors(). If it is
>> 0 from some buggy driver queue, prints a warning oops information and
>> set queue_logical_block_size(q) to a local variable discard_granularity.
>> This local variable is used in round_up() and round_down() calculation,
>> now req_sects won't be 0  and no empty discard request is generated.
>>
>> Fixes: 9b15d109a6b2 ("block: improve discard bio alignment in __blkdev_issue_discard()")
>> Fixes: c52abf563049 ("loop: Better discard support for block devices")
>> Reported-by: Ming Lei <ming.lei@redhat.com>
>> Signed-off-by: Coly Li <colyli@suse.de>
>> Cc: Hannes Reinecke <hare@suse.com>
>> Cc: Ming Lei <ming.lei@redhat.com>
>> Cc: Xiao Ni <xni@redhat.com>
>> Cc: Bart Van Assche <bvanassche@acm.org>
>> Cc: Christoph Hellwig <hch@lst.de>
>> Cc: Enzo Matsumiya <ematsumiya@suse.com>
>> Cc: Jens Axboe <axboe@kernel.dk>
>> Cc: Evan Green <evgreen@chromium.org>
>> ---
>>  block/blk-lib.c | 8 +++++++-
>>  block/blk.h     | 9 +++++++--
>>  2 files changed, 14 insertions(+), 3 deletions(-)
>>
>> diff --git a/block/blk-lib.c b/block/blk-lib.c
>> index 019e09bb9c0e..3017e4cba923 100644
>> --- a/block/blk-lib.c
>> +++ b/block/blk-lib.c
>> @@ -30,6 +30,7 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
>>  	struct bio *bio = *biop;
>>  	unsigned int op;
>>  	sector_t bs_mask, part_offset = 0;
>> +	sector_t discard_granularity;
>>  
>>  	if (!q)
>>  		return -ENXIO;
>> @@ -54,6 +55,11 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
>>  	if (!nr_sects)
>>  		return -EINVAL;
>>  
>> +	discard_granularity = q->limits.discard_granularity;
>> +	/* In case some buggy driver does not set limits.discard_granularity */
>> +	if (WARN_ON_ONCE(discard_granularity == 0))
>> +		discard_granularity = queue_logical_block_size(q);
> 
> This code path is supposed to not run in case of zero q->limits.discard_granularity,
> and looks it is fine to just warn and return -EINVAL in this case,
> see Documentation/ABI/testing/sysfs-block:
> 
> 	What:       /sys/block/<disk>/queue/discard_granularity
> 	Date:       May 2011
> 	Contact:    Martin K. Petersen <martin.petersen@oracle.com>
> 	Description:
> 	        Devices that support discard functionality may
> 	        internally allocate space using units that are bigger
> 	        than the logical block size. The discard_granularity
> 	        parameter indicates the size of the internal allocation
> 	        unit in bytes if reported by the device. Otherwise the
> 	        discard_granularity will be set to match the device's
> 	        physical block size. A discard_granularity of 0 means
> 	        that the device does not support discard functionality.
> 
> What we need to fix is loop driver, if it claims to support discard,
> q->limits.discard_granularity has to be one valid value.

Yes your suggestion is much simpler, let me do it :-)

Thanks.

Coly Li
Ming Lei Aug. 5, 2020, 2:46 a.m. UTC | #11
On Wed, Aug 05, 2020 at 09:54:00AM +0800, Coly Li wrote:
> On 2020/8/5 07:58, Ming Lei wrote:
> > On Tue, Aug 04, 2020 at 10:23:32PM +0800, Coly Li wrote:
> >> When some buggy driver doesn't set its queue->limits.discard_granularity
> >> (e.g. current loop device driver), discard at LBA 0 on such device will
> >> trigger a kernel BUG() panic from block/blk-mq.c:563.
> >>
> >> [  955.565006][   C39] ------------[ cut here ]------------
> >> [  955.559660][   C39] invalid opcode: 0000 [#1] SMP NOPTI
> >> [  955.622171][   C39] CPU: 39 PID: 248 Comm: ksoftirqd/39 Tainted: G            E     5.8.0-default+ #40
> >> [  955.622171][   C39] Hardware name: Lenovo ThinkSystem SR650 -[7X05CTO1WW]-/-[7X05CTO1WW]-, BIOS -[IVE160M-2.70]- 07/17/2020
> >> [  955.622175][   C39] RIP: 0010:blk_mq_end_request+0x107/0x110
> >> [  955.622177][   C39] Code: 48 8b 03 e9 59 ff ff ff 48 89 df 5b 5d 41 5c e9 9f ed ff ff 48 8b 35 98 3c f4 00 48 83 c7 10 48 83 c6 19 e8 cb 56 c9 ff eb cb <0f> 0b 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 54
> >> [  955.622179][   C39] RSP: 0018:ffffb1288701fe28 EFLAGS: 00010202
> >> [  955.749277][   C39] RAX: 0000000000000001 RBX: ffff956fffba5080 RCX: 0000000000004003
> >> [  955.749278][   C39] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000000
> >> [  955.749279][   C39] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
> >> [  955.749279][   C39] R10: ffffb1288701fd28 R11: 0000000000000001 R12: ffffffffa8e05160
> >> [  955.749280][   C39] R13: 0000000000000004 R14: 0000000000000004 R15: ffffffffa7ad3a1e
> >> [  955.749281][   C39] FS:  0000000000000000(0000) GS:ffff95bfbda00000(0000) knlGS:0000000000000000
> >> [  955.749282][   C39] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >> [  955.749282][   C39] CR2: 00007f6f0ef766a8 CR3: 0000005a37012002 CR4: 00000000007606e0
> >> [  955.749283][   C39] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> >> [  955.749284][   C39] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> >> [  955.749284][   C39] PKRU: 55555554
> >> [  955.749285][   C39] Call Trace:
> >> [  955.749290][   C39]  blk_done_softirq+0x99/0xc0
> >> [  957.550669][   C39]  __do_softirq+0xd3/0x45f
> >> [  957.550677][   C39]  ? smpboot_thread_fn+0x2f/0x1e0
> >> [  957.550679][   C39]  ? smpboot_thread_fn+0x74/0x1e0
> >> [  957.550680][   C39]  ? smpboot_thread_fn+0x14e/0x1e0
> >> [  957.550684][   C39]  run_ksoftirqd+0x30/0x60
> >> [  957.550687][   C39]  smpboot_thread_fn+0x149/0x1e0
> >> [  957.886225][   C39]  ? sort_range+0x20/0x20
> >> [  957.886226][   C39]  kthread+0x137/0x160
> >> [  957.886228][   C39]  ? kthread_park+0x90/0x90
> >> [  957.886231][   C39]  ret_from_fork+0x22/0x30
> >> [  959.117120][   C39] ---[ end trace 3dacdac97e2ed164 ]---
> >>
> >> This is the procedure to reproduce the panic,
> >>   # modprobe scsi_debug delay=0 dev_size_mb=2048 max_queue=1
> >>   # losetup -f /dev/nvme0n1 --direct-io=on
> >>   # blkdiscard /dev/loop0 -o 0 -l 0x200
> >>
> >> This is how the BUG() panic triggered by __blkdev_issue_discard(),
> >> - For a NVMe SSD backing loop device, the driver does not initialize
> >>   its queue->limits.discard_granularity and leaves it to 0.
> >> - When discard on LBA 0 of the loop device, __blkdev_issue_discard()
> >>   is called before loop device driver code.
> >> - Inside __blkdev_issue_discard(), when calculating value of
> >>   granularity_aligned_lba by
> >> 	granularity_aligned_lba = round_up(sector_mapped,
> >> 			q->limits.discard_granularity >> SECTOR_SHIFT);
> >>   because sector_mapped is 0 (at LBA 0 and no partition offset), and
> >>   q->limits.discard_granularity is 0 (by the buggy loop driver), the
> >>   calculated granularity_aligned_lba is 0.
> >> - The inline function bio_aligned_discard_max_sectors() is defined as
> >> 	return round_down(UINT_MAX, q->limits.discard_granularity) >>
> >> 			SECTOR_SHIFT;
> >>    when q->limits.discard_granularity is 0 from loop device driver, the
> >>    above calculation returns value 0.
> >> - Now granularity_aligned_lba and sctor_mapped are 0, req_sectors is
> >>   calculated by the following lines in __blkdev_issue_discard(),
> >> 	if (granularity_aligned_lba == sector_mapped)
> >> 		req_sects = min_t(sector_t, nr_sects,
> >> 				  bio_aligned_discard_max_sectors(q));
> >>   because bio_aligned_discard_max_sectors(q) returns 0, req_sects is
> >>   calculated as 0.
> >> - Now a discard bio is mistakenly initialized as a 0 byte bio by,
> >> 	bio->bi_iter.bi_size = req_sects << 9;
> >>   and sent to loop device driver.
> >> - This discard request is handled by loop device driver by following
> >>   code path,
> >>     loop_handle_cmd => do_req_filebacked => lo_fallocate =>
> >>     file->f_op->fallocate => blkdev_fallocate => blkdev_issue_zeroout =>
> >>     __blkdev_issue_write_zeroes
> >> - Inside __blkdev_issue_write_zeroes(), a 0 byte length discard bio is
> >>   composed and sent to the backing device of the loop device.
> >> - In the I/O completion code path, in my case it is,
> >>     blk_done_softirq => nrq->q->mq_ops->complete => nvme_pci_complete_rq
> >>     => nvme_complete_rq => blk_mq_end_request
> >>   inside blk_mq_end_request(), blk_update_request() is called and due to
> >>   req->bio is NULL in previous step, blk_update_request() returns false
> >>   then the BUG() panic in blk_mq_end_request() is triggered.
> >>
> >> Although the above panic can be fixed in loop device driver, the generic
> >> __blkdev_issue_discard() should also be fixed to tolerate the incorrect
> >> 0 value from queue->limits.discard_granularity, in case some other buggy
> >> driver makes such mistake again.
> >>
> >> This patch checks whether q->limits.discard_granularity is 0 in
> >> __blkdev_issue_discard() and bio_aligned_discard_max_sectors(). If it is
> >> 0 from some buggy driver queue, prints a warning oops information and
> >> set queue_logical_block_size(q) to a local variable discard_granularity.
> >> This local variable is used in round_up() and round_down() calculation,
> >> now req_sects won't be 0  and no empty discard request is generated.
> >>
> >> Fixes: 9b15d109a6b2 ("block: improve discard bio alignment in __blkdev_issue_discard()")
> >> Fixes: c52abf563049 ("loop: Better discard support for block devices")
> >> Reported-by: Ming Lei <ming.lei@redhat.com>
> >> Signed-off-by: Coly Li <colyli@suse.de>
> >> Cc: Hannes Reinecke <hare@suse.com>
> >> Cc: Ming Lei <ming.lei@redhat.com>
> >> Cc: Xiao Ni <xni@redhat.com>
> >> Cc: Bart Van Assche <bvanassche@acm.org>
> >> Cc: Christoph Hellwig <hch@lst.de>
> >> Cc: Enzo Matsumiya <ematsumiya@suse.com>
> >> Cc: Jens Axboe <axboe@kernel.dk>
> >> Cc: Evan Green <evgreen@chromium.org>
> >> ---
> >>  block/blk-lib.c | 8 +++++++-
> >>  block/blk.h     | 9 +++++++--
> >>  2 files changed, 14 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/block/blk-lib.c b/block/blk-lib.c
> >> index 019e09bb9c0e..3017e4cba923 100644
> >> --- a/block/blk-lib.c
> >> +++ b/block/blk-lib.c
> >> @@ -30,6 +30,7 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
> >>  	struct bio *bio = *biop;
> >>  	unsigned int op;
> >>  	sector_t bs_mask, part_offset = 0;
> >> +	sector_t discard_granularity;
> >>  
> >>  	if (!q)
> >>  		return -ENXIO;
> >> @@ -54,6 +55,11 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
> >>  	if (!nr_sects)
> >>  		return -EINVAL;
> >>  
> >> +	discard_granularity = q->limits.discard_granularity;
> >> +	/* In case some buggy driver does not set limits.discard_granularity */
> >> +	if (WARN_ON_ONCE(discard_granularity == 0))
> >> +		discard_granularity = queue_logical_block_size(q);
> > 
> > This code path is supposed to not run in case of zero q->limits.discard_granularity,
> > and looks it is fine to just warn and return -EINVAL in this case,
> > see Documentation/ABI/testing/sysfs-block:
> > 
> > 	What:       /sys/block/<disk>/queue/discard_granularity
> > 	Date:       May 2011
> > 	Contact:    Martin K. Petersen <martin.petersen@oracle.com>
> > 	Description:
> > 	        Devices that support discard functionality may
> > 	        internally allocate space using units that are bigger
> > 	        than the logical block size. The discard_granularity
> > 	        parameter indicates the size of the internal allocation
> > 	        unit in bytes if reported by the device. Otherwise the
> > 	        discard_granularity will be set to match the device's
> > 	        physical block size. A discard_granularity of 0 means
> > 	        that the device does not support discard functionality.
> > 
> > What we need to fix is loop driver, if it claims to support discard,
> > q->limits.discard_granularity has to be one valid value.
> 
> Yes your suggestion is much simpler, let me do it :-)

That is exactly what the following patch does:

https://lore.kernel.org/linux-block/6f642b8a-648e-8b59-067f-6c9f4cc32fa6@suse.de/T/#m82a878277ae7ed6b7a595820112fd13beaa24c99


Thanks,
Ming
Coly Li Aug. 5, 2020, 2:52 a.m. UTC | #12
On 2020/8/5 10:46, Ming Lei wrote:
> On Wed, Aug 05, 2020 at 09:54:00AM +0800, Coly Li wrote:
>> On 2020/8/5 07:58, Ming Lei wrote:
>>> On Tue, Aug 04, 2020 at 10:23:32PM +0800, Coly Li wrote:
>>>> When some buggy driver doesn't set its queue->limits.discard_granularity
>>>> (e.g. current loop device driver), discard at LBA 0 on such device will
>>>> trigger a kernel BUG() panic from block/blk-mq.c:563.
>>>>
>>>> [  955.565006][   C39] ------------[ cut here ]------------
>>>> [  955.559660][   C39] invalid opcode: 0000 [#1] SMP NOPTI
>>>> [  955.622171][   C39] CPU: 39 PID: 248 Comm: ksoftirqd/39 Tainted: G            E     5.8.0-default+ #40
>>>> [  955.622171][   C39] Hardware name: Lenovo ThinkSystem SR650 -[7X05CTO1WW]-/-[7X05CTO1WW]-, BIOS -[IVE160M-2.70]- 07/17/2020
>>>> [  955.622175][   C39] RIP: 0010:blk_mq_end_request+0x107/0x110
>>>> [  955.622177][   C39] Code: 48 8b 03 e9 59 ff ff ff 48 89 df 5b 5d 41 5c e9 9f ed ff ff 48 8b 35 98 3c f4 00 48 83 c7 10 48 83 c6 19 e8 cb 56 c9 ff eb cb <0f> 0b 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 54
>>>> [  955.622179][   C39] RSP: 0018:ffffb1288701fe28 EFLAGS: 00010202
>>>> [  955.749277][   C39] RAX: 0000000000000001 RBX: ffff956fffba5080 RCX: 0000000000004003
>>>> [  955.749278][   C39] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000000
>>>> [  955.749279][   C39] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
>>>> [  955.749279][   C39] R10: ffffb1288701fd28 R11: 0000000000000001 R12: ffffffffa8e05160
>>>> [  955.749280][   C39] R13: 0000000000000004 R14: 0000000000000004 R15: ffffffffa7ad3a1e
>>>> [  955.749281][   C39] FS:  0000000000000000(0000) GS:ffff95bfbda00000(0000) knlGS:0000000000000000
>>>> [  955.749282][   C39] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>> [  955.749282][   C39] CR2: 00007f6f0ef766a8 CR3: 0000005a37012002 CR4: 00000000007606e0
>>>> [  955.749283][   C39] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>>>> [  955.749284][   C39] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>>>> [  955.749284][   C39] PKRU: 55555554
>>>> [  955.749285][   C39] Call Trace:
>>>> [  955.749290][   C39]  blk_done_softirq+0x99/0xc0
>>>> [  957.550669][   C39]  __do_softirq+0xd3/0x45f
>>>> [  957.550677][   C39]  ? smpboot_thread_fn+0x2f/0x1e0
>>>> [  957.550679][   C39]  ? smpboot_thread_fn+0x74/0x1e0
>>>> [  957.550680][   C39]  ? smpboot_thread_fn+0x14e/0x1e0
>>>> [  957.550684][   C39]  run_ksoftirqd+0x30/0x60
>>>> [  957.550687][   C39]  smpboot_thread_fn+0x149/0x1e0
>>>> [  957.886225][   C39]  ? sort_range+0x20/0x20
>>>> [  957.886226][   C39]  kthread+0x137/0x160
>>>> [  957.886228][   C39]  ? kthread_park+0x90/0x90
>>>> [  957.886231][   C39]  ret_from_fork+0x22/0x30
>>>> [  959.117120][   C39] ---[ end trace 3dacdac97e2ed164 ]---
>>>>
>>>> This is the procedure to reproduce the panic,
>>>>   # modprobe scsi_debug delay=0 dev_size_mb=2048 max_queue=1
>>>>   # losetup -f /dev/nvme0n1 --direct-io=on
>>>>   # blkdiscard /dev/loop0 -o 0 -l 0x200
>>>>
>>>> This is how the BUG() panic triggered by __blkdev_issue_discard(),
>>>> - For a NVMe SSD backing loop device, the driver does not initialize
>>>>   its queue->limits.discard_granularity and leaves it to 0.
>>>> - When discard on LBA 0 of the loop device, __blkdev_issue_discard()
>>>>   is called before loop device driver code.
>>>> - Inside __blkdev_issue_discard(), when calculating value of
>>>>   granularity_aligned_lba by
>>>> 	granularity_aligned_lba = round_up(sector_mapped,
>>>> 			q->limits.discard_granularity >> SECTOR_SHIFT);
>>>>   because sector_mapped is 0 (at LBA 0 and no partition offset), and
>>>>   q->limits.discard_granularity is 0 (by the buggy loop driver), the
>>>>   calculated granularity_aligned_lba is 0.
>>>> - The inline function bio_aligned_discard_max_sectors() is defined as
>>>> 	return round_down(UINT_MAX, q->limits.discard_granularity) >>
>>>> 			SECTOR_SHIFT;
>>>>    when q->limits.discard_granularity is 0 from loop device driver, the
>>>>    above calculation returns value 0.
>>>> - Now granularity_aligned_lba and sctor_mapped are 0, req_sectors is
>>>>   calculated by the following lines in __blkdev_issue_discard(),
>>>> 	if (granularity_aligned_lba == sector_mapped)
>>>> 		req_sects = min_t(sector_t, nr_sects,
>>>> 				  bio_aligned_discard_max_sectors(q));
>>>>   because bio_aligned_discard_max_sectors(q) returns 0, req_sects is
>>>>   calculated as 0.
>>>> - Now a discard bio is mistakenly initialized as a 0 byte bio by,
>>>> 	bio->bi_iter.bi_size = req_sects << 9;
>>>>   and sent to loop device driver.
>>>> - This discard request is handled by loop device driver by following
>>>>   code path,
>>>>     loop_handle_cmd => do_req_filebacked => lo_fallocate =>
>>>>     file->f_op->fallocate => blkdev_fallocate => blkdev_issue_zeroout =>
>>>>     __blkdev_issue_write_zeroes
>>>> - Inside __blkdev_issue_write_zeroes(), a 0 byte length discard bio is
>>>>   composed and sent to the backing device of the loop device.
>>>> - In the I/O completion code path, in my case it is,
>>>>     blk_done_softirq => nrq->q->mq_ops->complete => nvme_pci_complete_rq
>>>>     => nvme_complete_rq => blk_mq_end_request
>>>>   inside blk_mq_end_request(), blk_update_request() is called and due to
>>>>   req->bio is NULL in previous step, blk_update_request() returns false
>>>>   then the BUG() panic in blk_mq_end_request() is triggered.
>>>>
>>>> Although the above panic can be fixed in loop device driver, the generic
>>>> __blkdev_issue_discard() should also be fixed to tolerate the incorrect
>>>> 0 value from queue->limits.discard_granularity, in case some other buggy
>>>> driver makes such mistake again.
>>>>
>>>> This patch checks whether q->limits.discard_granularity is 0 in
>>>> __blkdev_issue_discard() and bio_aligned_discard_max_sectors(). If it is
>>>> 0 from some buggy driver queue, prints a warning oops information and
>>>> set queue_logical_block_size(q) to a local variable discard_granularity.
>>>> This local variable is used in round_up() and round_down() calculation,
>>>> now req_sects won't be 0  and no empty discard request is generated.
>>>>
>>>> Fixes: 9b15d109a6b2 ("block: improve discard bio alignment in __blkdev_issue_discard()")
>>>> Fixes: c52abf563049 ("loop: Better discard support for block devices")
>>>> Reported-by: Ming Lei <ming.lei@redhat.com>
>>>> Signed-off-by: Coly Li <colyli@suse.de>
>>>> Cc: Hannes Reinecke <hare@suse.com>
>>>> Cc: Ming Lei <ming.lei@redhat.com>
>>>> Cc: Xiao Ni <xni@redhat.com>
>>>> Cc: Bart Van Assche <bvanassche@acm.org>
>>>> Cc: Christoph Hellwig <hch@lst.de>
>>>> Cc: Enzo Matsumiya <ematsumiya@suse.com>
>>>> Cc: Jens Axboe <axboe@kernel.dk>
>>>> Cc: Evan Green <evgreen@chromium.org>
>>>> ---
>>>>  block/blk-lib.c | 8 +++++++-
>>>>  block/blk.h     | 9 +++++++--
>>>>  2 files changed, 14 insertions(+), 3 deletions(-)
>>>>
>>>> diff --git a/block/blk-lib.c b/block/blk-lib.c
>>>> index 019e09bb9c0e..3017e4cba923 100644
>>>> --- a/block/blk-lib.c
>>>> +++ b/block/blk-lib.c
>>>> @@ -30,6 +30,7 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
>>>>  	struct bio *bio = *biop;
>>>>  	unsigned int op;
>>>>  	sector_t bs_mask, part_offset = 0;
>>>> +	sector_t discard_granularity;
>>>>  
>>>>  	if (!q)
>>>>  		return -ENXIO;
>>>> @@ -54,6 +55,11 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
>>>>  	if (!nr_sects)
>>>>  		return -EINVAL;
>>>>  
>>>> +	discard_granularity = q->limits.discard_granularity;
>>>> +	/* In case some buggy driver does not set limits.discard_granularity */
>>>> +	if (WARN_ON_ONCE(discard_granularity == 0))
>>>> +		discard_granularity = queue_logical_block_size(q);
>>>
>>> This code path is supposed to not run in case of zero q->limits.discard_granularity,
>>> and looks it is fine to just warn and return -EINVAL in this case,
>>> see Documentation/ABI/testing/sysfs-block:
>>>
>>> 	What:       /sys/block/<disk>/queue/discard_granularity
>>> 	Date:       May 2011
>>> 	Contact:    Martin K. Petersen <martin.petersen@oracle.com>
>>> 	Description:
>>> 	        Devices that support discard functionality may
>>> 	        internally allocate space using units that are bigger
>>> 	        than the logical block size. The discard_granularity
>>> 	        parameter indicates the size of the internal allocation
>>> 	        unit in bytes if reported by the device. Otherwise the
>>> 	        discard_granularity will be set to match the device's
>>> 	        physical block size. A discard_granularity of 0 means
>>> 	        that the device does not support discard functionality.
>>>
>>> What we need to fix is loop driver, if it claims to support discard,
>>> q->limits.discard_granularity has to be one valid value.
>>
>> Yes your suggestion is much simpler, let me do it :-)
> 
> That is exactly what the following patch does:
> 
> https://lore.kernel.org/linux-block/6f642b8a-648e-8b59-067f-6c9f4cc32fa6@suse.de/T/#m82a878277ae7ed6b7a595820112fd13beaa24c99

I meant your suggestion in __blkdev_issue_discard(), in case some other
buggy driver does similar fault in future. Now the v2 patch is much
simpler, please review it and thank you in advance :-)

Coly Li

Patch
diff mbox series

diff --git a/block/blk-lib.c b/block/blk-lib.c
index 019e09bb9c0e..3017e4cba923 100644
--- a/block/blk-lib.c
+++ b/block/blk-lib.c
@@ -30,6 +30,7 @@  int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
 	struct bio *bio = *biop;
 	unsigned int op;
 	sector_t bs_mask, part_offset = 0;
+	sector_t discard_granularity;
 
 	if (!q)
 		return -ENXIO;
@@ -54,6 +55,11 @@  int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
 	if (!nr_sects)
 		return -EINVAL;
 
+	discard_granularity = q->limits.discard_granularity;
+	/* In case some buggy driver does not set limits.discard_granularity */
+	if (WARN_ON_ONCE(discard_granularity == 0))
+		discard_granularity = queue_logical_block_size(q);
+
 	/* In case the discard request is in a partition */
 	if (bdev->bd_partno)
 		part_offset = bdev->bd_part->start_sect;
@@ -63,7 +69,7 @@  int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
 		sector_t sector_mapped = sector + part_offset;
 
 		granularity_aligned_lba = round_up(sector_mapped,
-				q->limits.discard_granularity >> SECTOR_SHIFT);
+				discard_granularity >> SECTOR_SHIFT);
 
 		/*
 		 * Check whether the discard bio starts at a discard_granularity
diff --git a/block/blk.h b/block/blk.h
index 49e2928a1632..b52aa7049fb0 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -274,8 +274,13 @@  static inline unsigned int bio_allowed_max_sectors(struct request_queue *q)
 static inline unsigned int bio_aligned_discard_max_sectors(
 					struct request_queue *q)
 {
-	return round_down(UINT_MAX, q->limits.discard_granularity) >>
-			SECTOR_SHIFT;
+	sector_t discard_granularity = q->limits.discard_granularity;
+
+	/* In case some buggy driver doesn't set >limits.discard_granularity */
+	if (WARN_ON_ONCE(discard_granularity == 0))
+		discard_granularity = queue_logical_block_size(q);
+
+	return round_down(UINT_MAX, discard_granularity) >> SECTOR_SHIFT;
 }
 
 /*