From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Jianpeng Ma <majianpeng@gmail.com>,
NeilBrown <neilb@suse.de>, Shaohua Li <shli@kernel.org>
Subject: [PATCH 3.12 63/83] md/raid5: Use conf->device_lock protect changing of multi-thread resources.
Date: Fri, 6 Dec 2013 13:51:53 -0800 [thread overview]
Message-ID: <20131206214645.903841426@linuxfoundation.org> (raw)
In-Reply-To: <20131206214640.002320724@linuxfoundation.org>
3.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: majianpeng <majianpeng@gmail.com>
commit 60aaf933854511630e16be4efe0f96485e132de4 upstream.
and commit 0c775d5208284700de423e6746259da54a42e1f5
When we change group_thread_cnt from sysfs entry, it can OOPS.
The kernel messages are:
[ 135.299021] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 135.299073] IP: [<ffffffff815188ab>] handle_active_stripes+0x32b/0x440
[ 135.299107] PGD 0
[ 135.299122] Oops: 0000 [#1] SMP
[ 135.299144] Modules linked in: netconsole e1000e ptp pps_core
[ 135.299188] CPU: 3 PID: 2225 Comm: md0_raid5 Not tainted 3.12.0+ #24
[ 135.299214] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M., BIOS 080015 11/09/2011
[ 135.299255] task: ffff8800b9638f80 ti: ffff8800b77a4000 task.ti: ffff8800b77a4000
[ 135.299283] RIP: 0010:[<ffffffff815188ab>] [<ffffffff815188ab>] handle_active_stripes+0x32b/0x440
[ 135.299323] RSP: 0018:ffff8800b77a5c48 EFLAGS: 00010002
[ 135.299344] RAX: ffff880037bb5c70 RBX: 0000000000000000 RCX: 0000000000000008
[ 135.299371] RDX: ffff880037bb5cb8 RSI: 0000000000000001 RDI: ffff880037bb5c00
[ 135.299398] RBP: ffff8800b77a5d08 R08: 0000000000000001 R09: 0000000000000000
[ 135.299425] R10: ffff8800b77a5c98 R11: 00000000ffffffff R12: ffff880037bb5c00
[ 135.299452] R13: 0000000000000000 R14: 0000000000000000 R15: ffff880037bb5c70
[ 135.299479] FS: 0000000000000000(0000) GS:ffff88013fd80000(0000) knlGS:0000000000000000
[ 135.299510] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 135.299532] CR2: 0000000000000000 CR3: 0000000001c0b000 CR4: 00000000000407e0
[ 135.299559] Stack:
[ 135.299570] ffff8800b77a5c88 ffffffff8107383e ffff8800b77a5c88 ffff880037a64300
[ 135.299611] 000000000000ec08 ffff880037bb5cb8 ffff8800b77a5c98 ffffffffffffffd8
[ 135.299654] 000000000000ec08 ffff880037bb5c60 ffff8800b77a5c98 ffff8800b77a5c98
[ 135.299696] Call Trace:
[ 135.299711] [<ffffffff8107383e>] ? __wake_up+0x4e/0x70
[ 135.299733] [<ffffffff81518f88>] raid5d+0x4c8/0x680
[ 135.299756] [<ffffffff817174ed>] ? schedule_timeout+0x15d/0x1f0
[ 135.299781] [<ffffffff81524c9f>] md_thread+0x11f/0x170
[ 135.299804] [<ffffffff81069cd0>] ? wake_up_bit+0x40/0x40
[ 135.299826] [<ffffffff81524b80>] ? md_rdev_init+0x110/0x110
[ 135.299850] [<ffffffff81069656>] kthread+0xc6/0xd0
[ 135.299871] [<ffffffff81069590>] ? kthread_freezable_should_stop+0x70/0x70
[ 135.299899] [<ffffffff81722ffc>] ret_from_fork+0x7c/0xb0
[ 135.299923] [<ffffffff81069590>] ? kthread_freezable_should_stop+0x70/0x70
[ 135.299951] Code: ff ff ff 0f 84 d7 fe ff ff e9 5c fe ff ff 66 90 41 8b b4 24 d8 01 00 00 45 31 ed 85 f6 0f 8e 7b fd ff ff 49 8b 9c 24 d0 01 00 00 <48> 3b 1b 49 89 dd 0f 85 67 fd ff ff 48 8d 43 28 31 d2 eb 17 90
[ 135.300005] RIP [<ffffffff815188ab>] handle_active_stripes+0x32b/0x440
[ 135.300005] RSP <ffff8800b77a5c48>
[ 135.300005] CR2: 0000000000000000
[ 135.300005] ---[ end trace 504854e5bb7562ed ]---
[ 135.300005] Kernel panic - not syncing: Fatal exception
This is because raid5d() can be running when the multi-thread
resources are changed via system. We see need to provide locking.
mddev->device_lock is suitable, but we cannot simple call
alloc_thread_groups under this lock as we cannot allocate memory
while holding a spinlock.
So change alloc_thread_groups() to allocate and return the data
structures, then raid5_store_group_thread_cnt() can take the lock
while updating the pointers to the data structures.
This fixes a bug introduced in 3.12 and so is suitable for the 3.12.x
stable series.
Fixes: b721420e8719131896b009b11edbbd27
Signed-off-by: Jianpeng Ma <majianpeng@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Reviewed-by: Shaohua Li <shli@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid5.c | 63 ++++++++++++++++++++++++++++++++---------------------
1 file changed, 39 insertions(+), 24 deletions(-)
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -5214,15 +5214,18 @@ raid5_show_group_thread_cnt(struct mddev
return 0;
}
-static int alloc_thread_groups(struct r5conf *conf, int cnt);
+static int alloc_thread_groups(struct r5conf *conf, int cnt,
+ int *group_cnt,
+ int *worker_cnt_per_group,
+ struct r5worker_group **worker_groups);
static ssize_t
raid5_store_group_thread_cnt(struct mddev *mddev, const char *page, size_t len)
{
struct r5conf *conf = mddev->private;
unsigned long new;
int err;
- struct r5worker_group *old_groups;
- int old_group_cnt;
+ struct r5worker_group *new_groups, *old_groups;
+ int group_cnt, worker_cnt_per_group;
if (len >= PAGE_SIZE)
return -EINVAL;
@@ -5238,17 +5241,19 @@ raid5_store_group_thread_cnt(struct mdde
mddev_suspend(mddev);
old_groups = conf->worker_groups;
- old_group_cnt = conf->worker_cnt_per_group;
-
if (old_groups)
flush_workqueue(raid5_wq);
- conf->worker_groups = NULL;
- err = alloc_thread_groups(conf, new);
- if (err) {
- conf->worker_groups = old_groups;
- conf->worker_cnt_per_group = old_group_cnt;
- } else {
+ err = alloc_thread_groups(conf, new,
+ &group_cnt, &worker_cnt_per_group,
+ &new_groups);
+ if (!err) {
+ spin_lock_irq(&conf->device_lock);
+ conf->group_cnt = group_cnt;
+ conf->worker_cnt_per_group = worker_cnt_per_group;
+ conf->worker_groups = new_groups;
+ spin_unlock_irq(&conf->device_lock);
+
if (old_groups)
kfree(old_groups[0].workers);
kfree(old_groups);
@@ -5278,33 +5283,36 @@ static struct attribute_group raid5_attr
.attrs = raid5_attrs,
};
-static int alloc_thread_groups(struct r5conf *conf, int cnt)
+static int alloc_thread_groups(struct r5conf *conf, int cnt,
+ int *group_cnt,
+ int *worker_cnt_per_group,
+ struct r5worker_group **worker_groups)
{
int i, j;
ssize_t size;
struct r5worker *workers;
- conf->worker_cnt_per_group = cnt;
+ *worker_cnt_per_group = cnt;
if (cnt == 0) {
- conf->worker_groups = NULL;
+ *group_cnt = 0;
+ *worker_groups = NULL;
return 0;
}
- conf->group_cnt = num_possible_nodes();
+ *group_cnt = num_possible_nodes();
size = sizeof(struct r5worker) * cnt;
- workers = kzalloc(size * conf->group_cnt, GFP_NOIO);
- conf->worker_groups = kzalloc(sizeof(struct r5worker_group) *
- conf->group_cnt, GFP_NOIO);
- if (!conf->worker_groups || !workers) {
+ workers = kzalloc(size * *group_cnt, GFP_NOIO);
+ *worker_groups = kzalloc(sizeof(struct r5worker_group) *
+ *group_cnt, GFP_NOIO);
+ if (!*worker_groups || !workers) {
kfree(workers);
- kfree(conf->worker_groups);
- conf->worker_groups = NULL;
+ kfree(*worker_groups);
return -ENOMEM;
}
- for (i = 0; i < conf->group_cnt; i++) {
+ for (i = 0; i < *group_cnt; i++) {
struct r5worker_group *group;
- group = &conf->worker_groups[i];
+ group = &(*worker_groups)[i];
INIT_LIST_HEAD(&group->handle_list);
group->conf = conf;
group->workers = workers + i * cnt;
@@ -5462,6 +5470,8 @@ static struct r5conf *setup_conf(struct
struct md_rdev *rdev;
struct disk_info *disk;
char pers_name[6];
+ int group_cnt, worker_cnt_per_group;
+ struct r5worker_group *new_group;
if (mddev->new_level != 5
&& mddev->new_level != 4
@@ -5496,7 +5506,12 @@ static struct r5conf *setup_conf(struct
if (conf == NULL)
goto abort;
/* Don't enable multi-threading by default*/
- if (alloc_thread_groups(conf, 0))
+ if (!alloc_thread_groups(conf, 0, &group_cnt, &worker_cnt_per_group,
+ &new_group)) {
+ conf->group_cnt = group_cnt;
+ conf->worker_cnt_per_group = worker_cnt_per_group;
+ conf->worker_groups = new_group;
+ } else
goto abort;
spin_lock_init(&conf->device_lock);
seqcount_init(&conf->gen_lock);
next prev parent reply other threads:[~2013-12-06 21:51 UTC|newest]
Thread overview: 90+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-06 21:50 [PATCH 3.12 00/83] 3.12.4-stable review Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 01/83] net: mv643xx_eth: Add missing phy_addr_set in DT mode Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 02/83] net: mv643xx_eth: potential NULL dereference in probe() Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 03/83] ipv6: fix headroom calculation in udp6_ufo_fragment Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 04/83] bonding: RCUify bond_set_rx_mode() Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 05/83] net: x86: bpf: dont forget to free sk_filter (v2) Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 06/83] net/mlx4_en: Fixed crash when port type is changed Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 07/83] net: Fix "ip rule delete table 256" Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 08/83] ipv6: use rt6_get_dflt_router to get default router in rt6_route_rcv Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 09/83] ipv6: protect for_each_sk_fl_rcu in mem_check with rcu_read_lock_bh Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 10/83] random32: fix off-by-one in seeding requirement Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 11/83] bonding: dont permit to use ARP monitoring in 802.3ad mode Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 12/83] usbnet: fix status interrupt urb handling Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 13/83] core/dev: do not ignore dmac in dev_forward_skb() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 14/83] 6lowpan: Uncompression of traffic class field was incorrect Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 15/83] tuntap: limit head length of skb allocated Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 16/83] macvtap: " Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 17/83] tcp: tsq: restore minimal amount of queueing Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 18/83] bonding: fix two race conditions in bond_store_updelay/downdelay Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 19/83] net-tcp: fix panic in tcp_fastopen_cache_set() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 20/83] sit: fix use after free of fb_tunnel_dev Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 21/83] isdnloop: use strlcpy() instead of strcpy() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 22/83] ip6tnl: fix use after free of fb_tnl_dev Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 23/83] pkt_sched: fq: change classification of control packets Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 24/83] connector: improved unaligned access error fix Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 25/83] ipv4: fix possible seqlock deadlock Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 26/83] pkt_sched: fq: warn users using defrate Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 27/83] pkt_sched: fq: fix pacing for small frames Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 28/83] inet: prevent leakage of uninitialized memory to user in recv syscalls Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 29/83] ping: prevent NULL pointer dereference on write to msg_name Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 30/83] net: rework recvmsg handler msg_name and msg_namelen logic Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 31/83] net: add BUG_ON if kernel advertises msg_namelen > sizeof(struct sockaddr_storage) Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 32/83] inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 33/83] net: clamp ->msg_namelen instead of returning an error Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 34/83] ipv6: fix leaking uninitialized port number of offender sockaddr Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 35/83] ipv6: Fix inet6_init() cleanup order Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 36/83] ip6_output: fragment outgoing reassembled skb properly Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 37/83] netfilter: push reasm skb through instead of original frag skbs Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 38/83] xfrm: Release dst if this dst is improper for vti tunnel Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 39/83] atm: idt77252: fix dev refcnt leak Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 40/83] tcp: dont update snd_nxt, when a socket is switched from repair mode Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 41/83] ipv4: fix race in concurrent ip_route_input_slow() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 42/83] net: core: Always propagate flag changes to interfaces Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 43/83] bridge: flush brs address entry in fdb when remove the bridge dev Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 44/83] packet: fix use after free race in send path when dev is released Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 45/83] af_packet: block BH in prb_shutdown_retire_blk_timer() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 46/83] gso: handle new frag_list of frags GRO packets Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 47/83] gro: Only verify TCP checksums for candidates Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 48/83] gro: Clean up tcpX_gro_receive checksum verification Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 49/83] sch_tbf: handle too small burst Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 50/83] xen-netback: include definition of csum_ipv6_magic Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 51/83] via-velocity: fix netif_receive_skb use in irq disabled section Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 52/83] r8169: check ALDPS bit and disable it if enabled for the 8168g Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 53/83] net: 8139cp: fix a BUG_ON triggered by wrong bytes_compl Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 54/83] net: smc91: fix crash regression on the versatile Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 55/83] net: update consumers of MSG_MORE to recognize MSG_SENDPAGE_NOTLAST Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 56/83] team: fix master carrier set when user linkup is enabled Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 57/83] inet: fix possible seqlock deadlocks Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 58/83] ipv6: fix possible seqlock deadlock in ip6_finish_output2 Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 59/83] {pktgen, xfrm} Update IPv4 header total len and checksum after tranformation Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 60/83] xfrm: Fix null pointer dereference when decoding sessions Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 61/83] xfs: add capability check to free eofblocks ioctl Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 62/83] mm: numa: return the number of base pages altered by protection changes Greg Kroah-Hartman
2013-12-06 21:51 ` Greg Kroah-Hartman [this message]
2013-12-06 21:51 ` [PATCH 3.12 64/83] usb: musb: davinci: fix resources passed to MUSB driver for DM6467 Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 65/83] usb: wusbcore: change WA_SEGS_MAX to a legal value Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 66/83] video: kyro: fix incorrect sizes when copying to userspace Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 67/83] HID: lg: fix Report Descriptor for Logitech MOMO Force (Black) Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 68/83] HID: hid-elo: some systems cannot stomach work around Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 69/83] iommu/vt-d: Fixed interaction of VFIO_IOMMU_MAP_DMA with IOMMU address limits Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 70/83] iommu: Remove stack trace from broken irq remapping warning Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 71/83] rt2800: add support for radio chip RF3070 Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 72/83] elevator: Fix a race in elevator switching and md device initialization Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 73/83] elevator: acquire q->sysfs_lock in elevator_change() Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 74/83] ntp: Make periodic RTC update more reliable Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 75/83] aio: Fix a trinity splat Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 76/83] take anon inode allocation to libfs.c Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 77/83] rework aio migrate pages to use aio fs Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 78/83] aio: checking for NULL instead of IS_ERR Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 79/83] aio: prevent double free in ioctx_alloc Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 80/83] aio: nullify aio->ring_pages after freeing it Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 81/83] aio: clean up aio ring in the fail path Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 82/83] drm/radeon/audio: improve ACR calculation Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 83/83] drm/radeon/audio: correct ACR table Greg Kroah-Hartman
2013-12-06 22:52 ` [PATCH 3.12 00/83] 3.12.4-stable review Holger Hoffstätte
2013-12-07 17:01 ` Greg KH
2013-12-07 6:44 ` Guenter Roeck
2013-12-07 17:00 ` Greg Kroah-Hartman
2013-12-07 22:15 ` Shuah Khan
2013-12-07 23:17 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131206214645.903841426@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=majianpeng@gmail.com \
--cc=neilb@suse.de \
--cc=shli@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).