From: Mike Snitzer <snitzer@redhat.com>
To: Bart Van Assche <bvanassche@acm.org>
Cc: device-mapper development <dm-devel@redhat.com>,
linux-scsi <linux-scsi@vger.kernel.org>,
Alasdair G Kergon <agk@redhat.com>, Jens Axboe <axboe@kernel.dk>,
Tejun Heo <tj@kernel.org>,
James Bottomley <JBottomley@parallels.com>
Subject: Re: [PATCH 2/2] dm: Avoid use-after-free of a mapped device
Date: Fri, 22 Feb 2013 06:08:29 -0500 [thread overview]
Message-ID: <20130222110829.GA30269@redhat.com> (raw)
In-Reply-To: <51274CC3.9070204@acm.org>
On Fri, Feb 22 2013 at 5:47am -0500,
Bart Van Assche <bvanassche@acm.org> wrote:
> As the comment above rq_completed() explains, md members must
> not be touched after the dm_put() at the end of that function
> has been invoked. Avoid that the md->queue can be run
> asynchronously after the last md reference has been dropped by
> running that queue synchronously. This patch fixes the
> following kernel oops:
>
> general protection fault: 0000 [#1] SMP
> RIP: 0010:[<ffffffff810fe754>] [<ffffffff810fe754>] mempool_free+0x24/0xb0
> Call Trace:
> <IRQ>
> [<ffffffff81187417>] bio_put+0x97/0xc0
> [<ffffffffa02247a5>] end_clone_bio+0x35/0x90 [dm_mod]
> [<ffffffff81185efd>] bio_endio+0x1d/0x30
> [<ffffffff811f03a3>] req_bio_endio.isra.51+0xa3/0xe0
> [<ffffffff811f2f68>] blk_update_request+0x118/0x520
> [<ffffffff811f3397>] blk_update_bidi_request+0x27/0xa0
> [<ffffffff811f343c>] blk_end_bidi_request+0x2c/0x80
> [<ffffffff811f34d0>] blk_end_request+0x10/0x20
> [<ffffffffa000b32b>] scsi_io_completion+0xfb/0x6c0 [scsi_mod]
> [<ffffffffa000107d>] scsi_finish_command+0xbd/0x120 [scsi_mod]
> [<ffffffffa000b12f>] scsi_softirq_done+0x13f/0x160 [scsi_mod]
> [<ffffffff811f9fd0>] blk_done_softirq+0x80/0xa0
> [<ffffffff81044551>] __do_softirq+0xf1/0x250
> [<ffffffff8142ee8c>] call_softirq+0x1c/0x30
> [<ffffffff8100420d>] do_softirq+0x8d/0xc0
> [<ffffffff81044885>] irq_exit+0xd5/0xe0
> [<ffffffff8142f3e3>] do_IRQ+0x63/0xe0
> [<ffffffff814257af>] common_interrupt+0x6f/0x6f
> <EOI>
> [<ffffffffa021737c>] srp_queuecommand+0x8c/0xcb0 [ib_srp]
> [<ffffffffa0002f18>] scsi_dispatch_cmd+0x148/0x310 [scsi_mod]
> [<ffffffffa000a38e>] scsi_request_fn+0x31e/0x520 [scsi_mod]
> [<ffffffff811f1e57>] __blk_run_queue+0x37/0x50
> [<ffffffff811f1f69>] blk_delay_work+0x29/0x40
> [<ffffffff81059003>] process_one_work+0x1c3/0x5c0
> [<ffffffff8105b22e>] worker_thread+0x15e/0x440
> [<ffffffff8106164b>] kthread+0xdb/0xe0
> [<ffffffff8142db9c>] ret_from_fork+0x7c/0xb0
Your commit header should probably reference commit
a8c32a5c98943d370ea606a2e7dc04717eb92206 ("dm: fix deadlock with request
based dm and queue request_fn recursion") and cc: stable with "v3.7+"
guidance.
Acked-by: Mike Snitzer <snitzer@redhat.com>
next prev parent reply other threads:[~2013-02-22 11:08 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-02-22 10:45 [PATCH 0/2] dm: Avoid use-after-free of a mapped device Bart Van Assche
2013-02-22 10:46 ` [PATCH 1/2] block: Avoid invoking blk_run_queue() recursively Bart Van Assche
2013-02-22 18:14 ` Tejun Heo
2013-02-22 18:57 ` Bart Van Assche
2013-02-22 19:01 ` Jens Axboe
2013-02-23 12:34 ` Bart Van Assche
2013-02-22 10:47 ` [PATCH 2/2] dm: Avoid use-after-free of a mapped device Bart Van Assche
2013-02-22 11:08 ` Mike Snitzer [this message]
2013-02-22 11:22 ` Bart Van Assche
2013-02-22 11:28 ` Mike Snitzer
2013-02-25 9:49 ` Jun'ichi Nomura
2013-02-25 15:09 ` Bart Van Assche
2013-02-26 0:30 ` Jun'ichi Nomura
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130222110829.GA30269@redhat.com \
--to=snitzer@redhat.com \
--cc=JBottomley@parallels.com \
--cc=agk@redhat.com \
--cc=axboe@kernel.dk \
--cc=bvanassche@acm.org \
--cc=dm-devel@redhat.com \
--cc=linux-scsi@vger.kernel.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.