From patchwork Sat Jan 7 01:03:01 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Williams X-Patchwork-Id: 9502621 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id EAF9B606B4 for ; Sat, 7 Jan 2017 01:07:23 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D8DB726E16 for ; Sat, 7 Jan 2017 01:07:23 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CDA8128554; Sat, 7 Jan 2017 01:07:23 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5456528551 for ; Sat, 7 Jan 2017 01:07:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1163256AbdAGBHO (ORCPT ); Fri, 6 Jan 2017 20:07:14 -0500 Received: from mga14.intel.com ([192.55.52.115]:64137 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1163248AbdAGBHJ (ORCPT ); Fri, 6 Jan 2017 20:07:09 -0500 Received: from orsmga001.jf.intel.com ([10.7.209.18]) by fmsmga103.fm.intel.com with ESMTP; 06 Jan 2017 17:07:08 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.33,327,1477983600"; d="scan'208";a="1080110773" Received: from dwillia2-desk3.jf.intel.com (HELO dwillia2-desk3.amr.corp.intel.com) ([10.54.39.14]) by orsmga001.jf.intel.com with ESMTP; 06 Jan 2017 17:07:08 -0800 Subject: [RFC PATCH v2 2/2] block: fix blk_get_backing_dev_info() crash, use bdev->bd_queue From: Dan Williams To: linux-block@vger.kernel.org Cc: Andi Kleen , Jan Kara , Rabin Vincent , linux-nvdimm@lists.01.org, linux-kernel@vger.kernel.org, Jens Axboe , Jeff Moyer , Wei Fang , linux-fsdevel@vger.kernel.org, Christoph Hellwig Date: Fri, 06 Jan 2017 17:03:01 -0800 Message-ID: <148375098178.37020.13124065464072336113.stgit@dwillia2-desk3.amr.corp.intel.com> In-Reply-To: <148375097100.37020.495735345355345658.stgit@dwillia2-desk3.amr.corp.intel.com> References: <148375097100.37020.495735345355345658.stgit@dwillia2-desk3.amr.corp.intel.com> User-Agent: StGit/0.17.1-9-g687f MIME-Version: 1.0 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The ->bd_queue member of struct block_device was added in commit 87192a2a49c4 ("vfs: cache request_queue in struct block_device") in v3.3. However, blk_get_backing_dev_info() has been using bdev_get_queue() and grabbing the request_queue through the gendisk since before the git era. At final __blkdev_put() time ->bd_disk is cleared while ->bd_queue is not. The queue remains valid until the final put of the parent disk. The following crash signature results from blk_get_backing_dev_info() trying to lookup the queue through ->bd_disk after the final put of the block device. Simply switch bdev_get_queue() to use ->bd_queue directly which is guaranteed to still be valid since the request_queue is alive as long as the inode corresponding to the bdev has not been destroyed. BUG: unable to handle kernel NULL pointer dereference at 0000000000000568 IP: blk_get_backing_dev_info+0x10/0x20 [..] Call Trace: __inode_attach_wb+0x3a7/0x5d0 __filemap_fdatawrite_range+0xf8/0x100 filemap_write_and_wait+0x40/0x90 fsync_bdev+0x54/0x60 ? bdget_disk+0x30/0x40 invalidate_partition+0x24/0x50 del_gendisk+0xfa/0x230 Cc: Jan Kara Cc: Jens Axboe Cc: Jeff Moyer Cc: Christoph Hellwig Cc: Wei Fang Cc: Rabin Vincent Cc: Andi Kleen Signed-off-by: Dan Williams --- block/blk-core.c | 4 ++-- include/linux/blkdev.h | 6 +++++- 2 files changed, 7 insertions(+), 3 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-block" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/block/blk-core.c b/block/blk-core.c index e8713137b846..cfd6731dfed7 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -108,8 +108,8 @@ void blk_queue_congestion_threshold(struct request_queue *q) * @bdev: device * * Locates the passed device's request queue and returns the address of its - * backing_dev_info. This function can only be called if @bdev is opened - * and the return value is never NULL. + * backing_dev_info. This function can be called until the final iput() + * of the bdev inode. */ struct backing_dev_info *blk_get_backing_dev_info(struct block_device *bdev) { diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index c47c358ba052..fd332da0fc38 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -841,7 +841,11 @@ bool blk_poll(struct request_queue *q, blk_qc_t cookie); static inline struct request_queue *bdev_get_queue(struct block_device *bdev) { - return bdev->bd_disk->queue; /* this is never NULL */ + /* + * ->bd_queue is valid as long as there is a reference against + * the bdev inode. + */ + return bdev->bd_queue; } /*