From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793207676; b=lm+YErmm09MjfhD6OKwJgHO3ELujd3AlQagJkRoZ+haHl8r34j+/Q80cVbdvzMnXVUmb 3xPbry8g5GUmOY2a0CtLxCSPmyO3SMusUEruRCdvrPUOlK72kV6tBJzBpIyT+r3q/30SI e9FWFSNTYYWAGZu/RGhY2VlyWFW9WeAqu3kZZI4RoOojMi74o4IMMjmsjpqzpvZgwcK8o p2lLUkNHgPZkma3nSjwEarXB1+TZsnC+XsylcyPa0acdBN0VwlNK9rsqGkGxbTDL33Xz0 n9ei8rlG0iYRDps6VnP1URAPcLmBRpW3u9BK+ykZ5aJZOcnL327JkX34K0PFQVppHrA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793207676; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=wxewN5N4pTRQ1g7OwMjJimiA0J6931LZEy6rdOlbhZE=; b=a3OtXt5aF9/TXSbf0b0ZcqumleW77Abf7OcNzWQLxawc57KiZ3/fdLfOfSjpidzgkMzN Z5UzWSCbBqQ9YI+4hEGi7y5C3uWCSkD+2MHTZFUxJgMeXpxMKstsPLn4U1T4i48/f0hf/ nXz9PNw4ECfwNkSvboKdzIyapud9OF/qnWqSlAXZhHhixP/93sK8F1/wmpC2dfQEviEXQ irFMjh1S2D+DCJj6vpmaqNok4v6KcX9O+5GVeqoxh1iiaetL5vv81bfriS7uVjAsyDvnb mQS7kvd4KTZJWPFffDxlnPQEC2rZ8c7nTDkxgNvSyMuev1Yz223xqtzMDX6QjSK3FNg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=fiDblbxN; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 32C4D606A31F; Wed, 28 Oct 2026 17:14:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=fiDblbxN Received: by smtp.kernel.org (Postfix) with ESMTPSA id 85F181F01825; Wed, 28 Oct 2026 17:14:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793207676; bh=wxewN5N4pTRQ1g7OwMjJimiA0J6931LZEy6rdOlbhZE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fiDblbxNLoHOTLNhZ5CbFdG+zcyozcO/f+BE164q0fFIy07wAVDGAGDsdcUUgFkfE s4rQ4fNkl4AVfVyldg5cSCUmKnEMTee2CJ2c1BIdRUg5Mw7Wc9MOvmDvHXIFs9Bkf+ ALbMv7S1R/Sv/rgBvU5MaRTfsQcoCLCSzTr77fRk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Benjamin Marzinski , Matthew Sakai , Ming-Hung Tsai , Mikulas Patocka Subject: [PATCH 6.12 100/247] dm cache: fix issue with background work locking Date: Wed, 28 Oct 2026 17:58:23 +0100 Message-ID: <20261028165949.763667633@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028165947.349197979@linuxfoundation.org> References: <20261028165947.349197979@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Benjamin Marzinski commit bc9781c0247de107876f32929f1637db93a42b34 upstream. dm cache used a rw_semaphore for background_work_lock. Write locks on rw_semaphores have strict owner semantics, but there was no guarantee that the process that locked background_work_lock was the same process that unlocked it. This can be easily seen using a kernel compiled with CONFIG_DEBUG_RWSEMS. Given a dm cache device , run: 'dmsetup suspend && dmsetup resume '. This will trigger a kernel warning: DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)) triggered by cache_resume(). To fix this, switch from a rw_semaphore to a spinlock and a wait queue. dm cache already has a wait queue and associated counter, migration_wait and nr_allocated_migrations, that was getting woken up when background work was getting completed, but wasn't actually used by anything. This is replaced by the background_work queue and counter. Fixes: b29d4986d0da ("dm cache: significant rework to leverage dm-bio-prison-v2") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Marzinski Reviewed-by: Matthew Sakai Reviewed-by: Ming-Hung Tsai Signed-off-by: Mikulas Patocka Signed-off-by: Greg Kroah-Hartman --- drivers/md/dm-cache-target.c | 55 +++++++++++++++++++++---------------------- 1 file changed, 28 insertions(+), 27 deletions(-) --- a/drivers/md/dm-cache-target.c +++ b/drivers/md/dm-cache-target.c @@ -339,8 +339,6 @@ struct cache { struct list_head invalidation_requests; sector_t migration_threshold; - wait_queue_head_t migration_wait; - atomic_t nr_allocated_migrations; /* * The number of in flight migrations that are performing @@ -396,7 +394,11 @@ struct cache { bool loaded_mappings:1; bool loaded_discards:1; - struct rw_semaphore background_work_lock; + /* background work management */ + bool background_work_allowed; + unsigned background_work_nr; + spinlock_t background_work_lock; + wait_queue_head_t background_work_wait; struct batcher committer; struct work_struct commit_ws; @@ -487,19 +489,13 @@ static struct dm_cache_migration *alloc_ memset(mg, 0, sizeof(*mg)); mg->cache = cache; - atomic_inc(&cache->nr_allocated_migrations); return mg; } static void free_migration(struct dm_cache_migration *mg) { - struct cache *cache = mg->cache; - - if (atomic_dec_and_test(&cache->nr_allocated_migrations)) - wake_up(&cache->migration_wait); - - mempool_free(mg, &cache->migration_pool); + mempool_free(mg, &mg->cache->migration_pool); } /*----------------------------------------------------------------*/ @@ -1029,34 +1025,39 @@ static void calc_discard_block_range(str static void prevent_background_work(struct cache *cache) { - lockdep_off(); - down_write(&cache->background_work_lock); - lockdep_on(); + spin_lock_irq(&cache->background_work_lock); + cache->background_work_allowed = false; + wait_event_lock_irq(cache->background_work_wait, + cache->background_work_nr == 0, + cache->background_work_lock); + spin_unlock_irq(&cache->background_work_lock); } static void allow_background_work(struct cache *cache) { - lockdep_off(); - up_write(&cache->background_work_lock); - lockdep_on(); + spin_lock_irq(&cache->background_work_lock); + cache->background_work_allowed = true; + spin_unlock_irq(&cache->background_work_lock); } static bool background_work_begin(struct cache *cache) { bool r; - lockdep_off(); - r = down_read_trylock(&cache->background_work_lock); - lockdep_on(); - + spin_lock_irq(&cache->background_work_lock); + r = cache->background_work_allowed; + if (r) + cache->background_work_nr++; + spin_unlock_irq(&cache->background_work_lock); return r; } static void background_work_end(struct cache *cache) { - lockdep_off(); - up_read(&cache->background_work_lock); - lockdep_on(); + spin_lock_irq(&cache->background_work_lock); + if (--cache->background_work_nr == 0) + wake_up(&cache->background_work_wait); + spin_unlock_irq(&cache->background_work_lock); } /*----------------------------------------------------------------*/ @@ -2515,9 +2516,7 @@ static int cache_create(struct cache_arg spin_lock_init(&cache->lock); bio_list_init(&cache->deferred_bios); - atomic_set(&cache->nr_allocated_migrations, 0); atomic_set(&cache->nr_io_migrations, 0); - init_waitqueue_head(&cache->migration_wait); r = -ENOMEM; atomic_set(&cache->nr_dirty, 0); @@ -2599,8 +2598,10 @@ static int cache_create(struct cache_arg issue_op, cache, cache->wq); dm_iot_init(&cache->tracker); - init_rwsem(&cache->background_work_lock); - prevent_background_work(cache); + init_waitqueue_head(&cache->background_work_wait); + spin_lock_init(&cache->background_work_lock); + cache->background_work_allowed = false; + cache->background_work_nr = 0; *result = cache; return 0;