From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793210079; b=qSqOnVk1g5MCIOfBEPWfcxXqbLCFJMpzWY9TfI/3BY35djhaIDjAku2exO4i3lw3G/ou 1K5oNtrDxwl2VTUc7mWWZk/OlDd8IavIVyHBFplB7Y3tDi3vv+JaZAGm10MpIC6InGMnj u0BV7aUoY8gEVZ+vId59HLwgvQS+GiEezAiM5fwAzaMie3SDwt7rRVtlxakpo84jXrTzk ovzrBRhDTmy5SSLZYbYBUOlE7gpr2K1O6M2U18f7kYHbozh6jOJ1Q9pDJiMI07YUDz2Rq fcr6N50v/S7KN92jGT5Oxcwz8/eV2B/W5oBT3wl0fgvGxxB2LHpLSWcC44l36AySHBw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793210079; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=rXCj02Q1yMZChi9HenAQSJ/B+h8B/n2Ns1LVk4Y7OQY=; b=gf5vWghdeBreiehNp+idG9mC5M9uW4M4LObyjYz1oWdLa5dZ0jEcwd6z6Z+wEpvDELaq nx8Fx5HlEeHZ0o6H0Lh62Gpxt8EM8kLyHJFdXJ3bJRky6P5nhgvNdwhwImRgZ2OZIKxHb Ebsj6S1E4/duN8iq3QjpTS/ijW4s5629Gmc6jIzJASXdrAxgr5d1FYEqU6RfSfC02fTnp VdMr7XXgE5FD89GLb9tQSOUhOeS0zNveAdVAXhmzTx35GqBiMKqlvmT8oqujzAnTYMRob szBJq7KbK0wElS5YAGfGlP2p0u8uFrapdDY5As5IIFsJ5h1h10aNAfNojM8a+aFjc3A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=DzCBwTli; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3F3B3606A31A; Wed, 28 Oct 2026 17:54:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=DzCBwTli Received: by smtp.kernel.org (Postfix) with ESMTPSA id 90E721F01825; Wed, 28 Oct 2026 17:54:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793210079; bh=rXCj02Q1yMZChi9HenAQSJ/B+h8B/n2Ns1LVk4Y7OQY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=DzCBwTliwoNweXWzoCH08yeK4E5HTsSya6qR4yLbyRZC9BfmodAR1r1GOCxHdhYTo szUNN84PFoun/VZO52T0yewvsFynO57S4on4IpkkgIuIclfkHYrbRwYUpJUhqpaMqw ByJGEfUWmpQAtG6dSw17qDs5aXzGEXSZu3HJXpgs= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Benjamin Marzinski , Matthew Sakai , Ming-Hung Tsai , Mikulas Patocka Subject: [PATCH 6.6 069/168] dm cache: fix issue with background work locking Date: Wed, 28 Oct 2026 18:00:05 +0100 Message-ID: <20261028165944.720106158@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028165943.089486480@linuxfoundation.org> References: <20261028165943.089486480@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Benjamin Marzinski commit bc9781c0247de107876f32929f1637db93a42b34 upstream. dm cache used a rw_semaphore for background_work_lock. Write locks on rw_semaphores have strict owner semantics, but there was no guarantee that the process that locked background_work_lock was the same process that unlocked it. This can be easily seen using a kernel compiled with CONFIG_DEBUG_RWSEMS. Given a dm cache device , run: 'dmsetup suspend && dmsetup resume '. This will trigger a kernel warning: DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)) triggered by cache_resume(). To fix this, switch from a rw_semaphore to a spinlock and a wait queue. dm cache already has a wait queue and associated counter, migration_wait and nr_allocated_migrations, that was getting woken up when background work was getting completed, but wasn't actually used by anything. This is replaced by the background_work queue and counter. Fixes: b29d4986d0da ("dm cache: significant rework to leverage dm-bio-prison-v2") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Marzinski Reviewed-by: Matthew Sakai Reviewed-by: Ming-Hung Tsai Signed-off-by: Mikulas Patocka Signed-off-by: Greg Kroah-Hartman --- drivers/md/dm-cache-target.c | 55 +++++++++++++++++++++---------------------- 1 file changed, 28 insertions(+), 27 deletions(-) --- a/drivers/md/dm-cache-target.c +++ b/drivers/md/dm-cache-target.c @@ -340,8 +340,6 @@ struct cache { struct list_head invalidation_requests; sector_t migration_threshold; - wait_queue_head_t migration_wait; - atomic_t nr_allocated_migrations; /* * The number of in flight migrations that are performing @@ -397,7 +395,11 @@ struct cache { bool loaded_mappings:1; bool loaded_discards:1; - struct rw_semaphore background_work_lock; + /* background work management */ + bool background_work_allowed; + unsigned background_work_nr; + spinlock_t background_work_lock; + wait_queue_head_t background_work_wait; struct batcher committer; struct work_struct commit_ws; @@ -488,19 +490,13 @@ static struct dm_cache_migration *alloc_ memset(mg, 0, sizeof(*mg)); mg->cache = cache; - atomic_inc(&cache->nr_allocated_migrations); return mg; } static void free_migration(struct dm_cache_migration *mg) { - struct cache *cache = mg->cache; - - if (atomic_dec_and_test(&cache->nr_allocated_migrations)) - wake_up(&cache->migration_wait); - - mempool_free(mg, &cache->migration_pool); + mempool_free(mg, &mg->cache->migration_pool); } /*----------------------------------------------------------------*/ @@ -1031,34 +1027,39 @@ static void calc_discard_block_range(str static void prevent_background_work(struct cache *cache) { - lockdep_off(); - down_write(&cache->background_work_lock); - lockdep_on(); + spin_lock_irq(&cache->background_work_lock); + cache->background_work_allowed = false; + wait_event_lock_irq(cache->background_work_wait, + cache->background_work_nr == 0, + cache->background_work_lock); + spin_unlock_irq(&cache->background_work_lock); } static void allow_background_work(struct cache *cache) { - lockdep_off(); - up_write(&cache->background_work_lock); - lockdep_on(); + spin_lock_irq(&cache->background_work_lock); + cache->background_work_allowed = true; + spin_unlock_irq(&cache->background_work_lock); } static bool background_work_begin(struct cache *cache) { bool r; - lockdep_off(); - r = down_read_trylock(&cache->background_work_lock); - lockdep_on(); - + spin_lock_irq(&cache->background_work_lock); + r = cache->background_work_allowed; + if (r) + cache->background_work_nr++; + spin_unlock_irq(&cache->background_work_lock); return r; } static void background_work_end(struct cache *cache) { - lockdep_off(); - up_read(&cache->background_work_lock); - lockdep_on(); + spin_lock_irq(&cache->background_work_lock); + if (--cache->background_work_nr == 0) + wake_up(&cache->background_work_wait); + spin_unlock_irq(&cache->background_work_lock); } /*----------------------------------------------------------------*/ @@ -2519,9 +2520,7 @@ static int cache_create(struct cache_arg spin_lock_init(&cache->lock); bio_list_init(&cache->deferred_bios); - atomic_set(&cache->nr_allocated_migrations, 0); atomic_set(&cache->nr_io_migrations, 0); - init_waitqueue_head(&cache->migration_wait); r = -ENOMEM; atomic_set(&cache->nr_dirty, 0); @@ -2603,8 +2602,10 @@ static int cache_create(struct cache_arg issue_op, cache, cache->wq); dm_iot_init(&cache->tracker); - init_rwsem(&cache->background_work_lock); - prevent_background_work(cache); + init_waitqueue_head(&cache->background_work_wait); + spin_lock_init(&cache->background_work_lock); + cache->background_work_allowed = false; + cache->background_work_nr = 0; *result = cache; return 0;