From patchwork Sat Feb 11 03:40:45 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ming Lei X-Patchwork-Id: 9567825 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 8A5F460573 for ; Sat, 11 Feb 2017 03:40:58 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 67FA4285AC for ; Sat, 11 Feb 2017 03:40:58 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 50C81285E9; Sat, 11 Feb 2017 03:40:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E403F285AC for ; Sat, 11 Feb 2017 03:40:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751989AbdBKDk4 (ORCPT ); Fri, 10 Feb 2017 22:40:56 -0500 Received: from mail-pg0-f66.google.com ([74.125.83.66]:33226 "EHLO mail-pg0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751716AbdBKDkz (ORCPT ); Fri, 10 Feb 2017 22:40:55 -0500 Received: by mail-pg0-f66.google.com with SMTP id 194so4426876pgd.0; Fri, 10 Feb 2017 19:40:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=68fRCiDm9/ucEVTgeCNvmIoXy3XouE/k9gVakT9uwOo=; b=Y8gk3hHFo/fHd15nKiFhO3hnZAl+69QF9FU6Z647Y1yvFEVmeT6b9IbLmurpupq7SE z5RngxGbA5h8jzaz6qoC8KU4v5keDYvCBNunCJhDSzer3WazuaMgeyHSGsHS/f+odDS3 UkqCiznlvxKHyGuD/EwT/2DWbohjU2omvPSfoMYEOh99IaRwA9gRiUZHAgkjsdi41Er7 AWa3o6ITQy36KEPteC5r9KQV8tboDJdOJWmYyuzP5AsZOxNIGk6e/sTX2ZcLFXMJQZ5t wPtsHgGCa4oZ764qlvR/N+If3HCfUgtEqVoLFQncnycKL0U7BgVofXEpbBtgypqNmGXa UPhg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=68fRCiDm9/ucEVTgeCNvmIoXy3XouE/k9gVakT9uwOo=; b=otVt0QC0LG40LuuHoSxzqQXtEda9mMvolNfa+V4C+eU5rYwLkuGK5C73hnA98UXiB9 cnp1I2VZnSLRq04ZQTr4BYkWsfBAQ2Yx9IlU/9pWNkAEHh41xWFX6meSdMD6OV5QCHd8 gubmf1O/RsrSWjI5uCWCiqjjQSo5IlpKfs/NXZl1NjcK1+LwpUdhDMmCNwKNCFeK9Vn3 K75w8pn8CozY8cmap3jliq9rxmCQD30w3tCTN4CANZnL2EkJ8kxkL0cb6E4C4JSV+E/W 50GyLaJYo/O2rHul+rmtt7pG+NM2LYqAzpVLmm7Z1i6wlolrL5ZkArt6sybcT20IZjWc XbCA== X-Gm-Message-State: AMke39kLLnL9VjJAUJ7ocWE2t0+gG0U/7I94VDVW0kxTWLSactoVPZx9fM/oyWcyaET25w== X-Received: by 10.98.134.2 with SMTP id x2mr14263209pfd.158.1486784454708; Fri, 10 Feb 2017 19:40:54 -0800 (PST) Received: from localhost (li405-222.members.linode.com. [106.187.53.222]) by smtp.gmail.com with ESMTPSA id x16sm8022722pfk.79.2017.02.10.19.40.53 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 10 Feb 2017 19:40:54 -0800 (PST) From: Ming Lei To: Jens Axboe , linux-kernel@vger.kernel.org Cc: linux-block@vger.kernel.org, Christoph Hellwig , Dmitry Vyukov , Ming Lei , stable@vger.kernel.org Subject: [PATCH] block/loop: fix race between I/O and set_status Date: Sat, 11 Feb 2017 11:40:45 +0800 Message-Id: <1486784445-25300-1-git-send-email-tom.leiming@gmail.com> X-Mailer: git-send-email 2.7.4 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Inside set_status, transfer need to setup again, so we have to drain IO before the transition, otherwise oops may be triggered like the following: divide error: 0000 [#1] SMP KASAN CPU: 0 PID: 2935 Comm: loop7 Not tainted 4.10.0-rc7+ #213 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88006ba1e840 task.stack: ffff880067338000 RIP: 0010:transfer_xor+0x1d1/0x440 drivers/block/loop.c:110 RSP: 0018:ffff88006733f108 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8800688d7000 RCX: 0000000000000059 RDX: 0000000000000000 RSI: 1ffff1000d743f43 RDI: ffff880068891c08 RBP: ffff88006733f160 R08: ffff8800688d7001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800688d7000 R13: ffff880067b7d000 R14: dffffc0000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88006d000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000006c17e0 CR3: 0000000066e3b000 CR4: 00000000001406f0 Call Trace: lo_do_transfer drivers/block/loop.c:251 [inline] lo_read_transfer drivers/block/loop.c:392 [inline] do_req_filebacked drivers/block/loop.c:541 [inline] loop_handle_cmd drivers/block/loop.c:1677 [inline] loop_queue_work+0xda0/0x49b0 drivers/block/loop.c:1689 kthread_worker_fn+0x4c3/0xa30 kernel/kthread.c:630 kthread+0x326/0x3f0 kernel/kthread.c:227 ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430 Code: 03 83 e2 07 41 29 df 42 0f b6 04 30 4d 8d 44 24 01 38 d0 7f 08 84 c0 0f 85 62 02 00 00 44 89 f8 41 0f b6 48 ff 25 ff 01 00 00 99 7d c8 48 63 d2 48 03 55 d0 48 89 d0 48 89 d7 48 c1 e8 03 83 RIP: transfer_xor+0x1d1/0x440 drivers/block/loop.c:110 RSP: ffff88006733f108 ---[ end trace 0166f7bd3b0c0933 ]--- Reported-by: Dmitry Vyukov Cc: stable@vger.kernel.org Signed-off-by: Ming Lei --- drivers/block/loop.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index ed5259510857..4b52a1690329 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1097,9 +1097,12 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) if ((unsigned int) info->lo_encrypt_key_size > LO_KEY_SIZE) return -EINVAL; + /* I/O need to be drained during transfer transition */ + blk_mq_freeze_queue(lo->lo_queue); + err = loop_release_xfer(lo); if (err) - return err; + goto exit; if (info->lo_encrypt_type) { unsigned int type = info->lo_encrypt_type; @@ -1114,12 +1117,14 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) err = loop_init_xfer(lo, xfer, info); if (err) - return err; + goto exit; if (lo->lo_offset != info->lo_offset || lo->lo_sizelimit != info->lo_sizelimit) - if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit)) - return -EFBIG; + if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit)) { + err = -EFBIG; + goto exit; + } loop_config_discard(lo); @@ -1156,7 +1161,9 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) /* update dio if lo_offset or transfer is changed */ __loop_update_dio(lo, lo->use_dio); - return 0; + exit: + blk_mq_unfreeze_queue(lo->lo_queue); + return err; } static int