From: Coly Li <colyli@suse.de>
To: axboe@kernel.dk
Cc: linux-bcache@vger.kernel.org, linux-block@vger.kernel.org,
Dongsheng Yang <dongsheng.yang@easystack.cn>,
Coly Li <colyli@suse.de>
Subject: [PATCH 02/15] bcache: check c->root with IS_ERR_OR_NULL() in mca_reserve()
Date: Thu, 1 Oct 2020 14:50:43 +0800 [thread overview]
Message-ID: <20201001065056.24411-3-colyli@suse.de> (raw)
In-Reply-To: <20201001065056.24411-1-colyli@suse.de>
From: Dongsheng Yang <dongsheng.yang@easystack.cn>
In mca_reserve(c) macro, we are checking root whether is NULL or not.
But that's not enough, when we read the root node in run_cache_set(),
if we got an error in bch_btree_node_read_done(), we will return
ERR_PTR(-EIO) to c->root.
And then we will go continue to unregister, but before calling
unregister_shrinker(&c->shrink), there is a possibility to call
bch_mca_count(), and we would get a crash with call trace like that:
[ 2149.876008] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b5
... ...
[ 2150.598931] Call trace:
[ 2150.606439] bch_mca_count+0x58/0x98 [escache]
[ 2150.615866] do_shrink_slab+0x54/0x310
[ 2150.624429] shrink_slab+0x248/0x2d0
[ 2150.632633] drop_slab_node+0x54/0x88
[ 2150.640746] drop_slab+0x50/0x88
[ 2150.648228] drop_caches_sysctl_handler+0xf0/0x118
[ 2150.657219] proc_sys_call_handler.isra.18+0xb8/0x110
[ 2150.666342] proc_sys_write+0x40/0x50
[ 2150.673889] __vfs_write+0x48/0x90
[ 2150.681095] vfs_write+0xac/0x1b8
[ 2150.688145] ksys_write+0x6c/0xd0
[ 2150.695127] __arm64_sys_write+0x24/0x30
[ 2150.702749] el0_svc_handler+0xa0/0x128
[ 2150.710296] el0_svc+0x8/0xc
Signed-off-by: Dongsheng Yang <dongsheng.yang@easystack.cn>
Signed-off-by: Coly Li <colyli@suse.de>
---
drivers/md/bcache/btree.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 3d8bd0692af3..ae7611fa42bf 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -514,7 +514,7 @@ static void bch_btree_leaf_dirty(struct btree *b, atomic_t *journal_ref)
* mca -> memory cache
*/
-#define mca_reserve(c) (((c->root && c->root->level) \
+#define mca_reserve(c) (((!IS_ERR_OR_NULL(c->root) && c->root->level) \
? c->root->level : 1) * 8 + 16)
#define mca_can_free(c) \
max_t(int, 0, c->btree_cache_used - mca_reserve(c))
--
2.26.2
next prev parent reply other threads:[~2020-10-01 6:51 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-01 6:50 [PATCH 00/15] bcache patches for Linux v5.10 Coly Li
2020-10-01 6:50 ` [PATCH 01/15] bcache: share register sysfs with async register Coly Li
2020-10-01 21:19 ` Jens Axboe
2020-10-02 1:51 ` Coly Li
2020-10-01 6:50 ` Coly Li [this message]
2020-10-01 6:50 ` [PATCH 03/15] bcache: Convert to DEFINE_SHOW_ATTRIBUTE Coly Li
2020-10-01 6:50 ` [PATCH 04/15] bcache: remove 'int n' from parameter list of bch_bucket_alloc_set() Coly Li
2020-10-01 6:50 ` [PATCH 05/15] bcache: explicitly make cache_set only have single cache Coly Li
2020-10-01 6:50 ` [PATCH 06/15] bcache: remove for_each_cache() Coly Li
2020-10-01 6:50 ` [PATCH 07/15] bcache: add set_uuid in struct cache_set Coly Li
2020-10-01 6:50 ` [PATCH 08/15] bcache: only use block_bytes() on struct cache Coly Li
2020-10-01 6:50 ` [PATCH 09/15] bcache: remove useless alloc_bucket_pages() Coly Li
2020-10-01 6:50 ` [PATCH 10/15] bcache: remove useless bucket_pages() Coly Li
2020-10-01 6:50 ` [PATCH 11/15] bcache: only use bucket_bytes() on struct cache Coly Li
2020-10-01 6:50 ` [PATCH 12/15] bcache: don't check seq numbers in register_cache_set() Coly Li
2020-10-01 6:50 ` [PATCH 13/15] bcache: remove can_attach_cache() Coly Li
2020-10-01 6:50 ` [PATCH 14/15] bcache: check and set sync status on cache's in-memory super block Coly Li
2020-10-01 6:50 ` [PATCH 15/15] bcache: remove embedded struct cache_sb from struct cache_set Coly Li
2020-10-02 20:29 ` [PATCH 00/15] bcache patches for Linux v5.10 Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201001065056.24411-3-colyli@suse.de \
--to=colyli@suse.de \
--cc=axboe@kernel.dk \
--cc=dongsheng.yang@easystack.cn \
--cc=linux-bcache@vger.kernel.org \
--cc=linux-block@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).