From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D3A5AC10F25 for ; Mon, 9 Mar 2020 20:06:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B0B6F2253D for ; Mon, 9 Mar 2020 20:06:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1583784365; bh=jBySBX9mg179I+v5jdUaJfSacHIO5uGzoQ4om7HQHc8=; h=Subject:To:Cc:From:Date:List-ID:From; b=ozTPWRQypdju1ZoyMH9e+Ha2q/HcokkJltTEe7ShhfZoN567zXnfEc01oEqKwm8XG 3bg1UabzmNgYHr2P8nwGUIy1AnBcba6eu4Z+d4+We2v190cgjP6rrIYgdTnw+u2wd2 5OdyYpi1ZjzhzJpAFMGau0ssfFKIqS9wfgaEGrck= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725992AbgCIUGF (ORCPT ); Mon, 9 Mar 2020 16:06:05 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:42205 "EHLO out2-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726096AbgCIUGF (ORCPT ); Mon, 9 Mar 2020 16:06:05 -0400 Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 78C8821FE7; Mon, 9 Mar 2020 16:06:04 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute1.internal (MEProxy); Mon, 09 Mar 2020 16:06:04 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:message-id:mime-version:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=93i6RV D0aX0P8w3CdLJVXUciOPa4ebI+8VHMxXuUvIM=; b=cMDzXCI2Y9fanqRCk6mPL8 WTy4GKp4Fo2ji9Dmhmwz7W5YUBXcxIFxyNx7Np3yFC3vGku4obiBYKlG1A7XuDuK XCCymyw4OnuNOmbivZ9jSVV5q6GkCav6Gpe8zzxnG09U1IDhIfofhzpTNKd8POLY 6AIjFWBaqjZeD76IdmO8s+P46KdCI9Pc2KCZW/LEe29mEvknKUVkJpxfwszf+oTM r2sJPKqwDQ+bVuO+QhuoNhKw9dHQYtFohsYMosXYzSZjhf/7pQ8XwgzYXdQnZqn1 IhTt1vKr4kS2bb76YjcPtoyCQpiPHqN2xhmRT4KSsqF0cULlXpE/lGNtbZKZfScg == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedugedruddukedgudefvdcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecunecujfgurhepuffvhfffkfggtgfgsehtkeertd dttdflnecuhfhrohhmpeeoghhrvghgkhhhsehlihhnuhigfhhouhhnuggrthhiohhnrdho rhhgqeenucfkphepkeefrdekiedrkeelrddutdejnecuvehluhhsthgvrhfuihiivgepvd enucfrrghrrghmpehmrghilhhfrhhomhepghhrvghgsehkrhhorghhrdgtohhm X-ME-Proxy: Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) by mail.messagingengine.com (Postfix) with ESMTPA id 02B523280060; Mon, 9 Mar 2020 16:06:03 -0400 (EDT) Subject: FAILED: patch "[PATCH] dm cache: fix a crash due to incorrect work item cancelling" failed to apply to 4.9-stable tree To: mpatocka@redhat.com, snitzer@redhat.com Cc: From: Date: Mon, 09 Mar 2020 21:06:02 +0100 Message-ID: <158378436239197@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 7cdf6a0aae1cccf5167f3f04ecddcf648b78e289 Mon Sep 17 00:00:00 2001 From: Mikulas Patocka Date: Wed, 19 Feb 2020 10:25:45 -0500 Subject: [PATCH] dm cache: fix a crash due to incorrect work item cancelling The crash can be reproduced by running the lvm2 testsuite test lvconvert-thin-external-cache.sh for several minutes, e.g.: while :; do make check T=shell/lvconvert-thin-external-cache.sh; done The crash happens in this call chain: do_waker -> policy_tick -> smq_tick -> end_hotspot_period -> clear_bitset -> memset -> __memset -- which accesses an invalid pointer in the vmalloc area. The work entry on the workqueue is executed even after the bitmap was freed. The problem is that cancel_delayed_work doesn't wait for the running work item to finish, so the work item can continue running and re-submitting itself even after cache_postsuspend. In order to make sure that the work item won't be running, we must use cancel_delayed_work_sync. Also, change flush_workqueue to drain_workqueue, so that if some work item submits itself or another work item, we are properly waiting for both of them. Fixes: c6b4fcbad044 ("dm: add cache target") Cc: stable@vger.kernel.org # v3.9 Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c index 2d32821b3a5b..f4be63671233 100644 --- a/drivers/md/dm-cache-target.c +++ b/drivers/md/dm-cache-target.c @@ -2846,8 +2846,8 @@ static void cache_postsuspend(struct dm_target *ti) prevent_background_work(cache); BUG_ON(atomic_read(&cache->nr_io_migrations)); - cancel_delayed_work(&cache->waker); - flush_workqueue(cache->wq); + cancel_delayed_work_sync(&cache->waker); + drain_workqueue(cache->wq); WARN_ON(cache->tracker.in_flight); /*