percpu_counter: Add NULL check to prevent crash in __percpu_counter_add

From: Niranjan Dighe <[email protected]>

Following kernel crash was observed because of a possible race condition in block layer that passes struct percpu_counter *fcp with fcp->counters field NULL. Added extra checks to prevent similar crashes because of bugs in the upper layers.

This is fairly easy to reproduce with kernel 4.1.15+ when a USB device is mounted on multiple mount points with a -B (bind) option and multiple connection/disconnections are made repeatedly.

---

Unable to handle kernel paging request at virtual address 2ac60000
pgd = a2918000
[2ac60000] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT SMP ARM
Modules linked in: vfat fat sd_mod ntfs usb_storage scsi_mod usbhid hid
snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi fuse sd8xxx(O) mlan(PO)
mmc_block spidev sdhci_esdhc_imx sdhci_pltfm sdhci spi_imx spi_bitbang ext4
jbd2 ipv6
CPU: 0 PID: 319 Comm: usbmgr Tainted: P        W  O    4.1.15-1.2.0+g77f6154 #2
Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
task: a23b7c00 ti: a843c000 task.ti: a843c000
PC is at __percpu_counter_add+0x34/0xf8
LR is at clear_page_dirty_for_io+0xc4/0xe0
pc : [<80213708>]    lr : [<80098810>]    psr: 200f0093

sp : a843de00 ip : a843de00 fp : abb6a0a0
r10: a843def8 r9 : 0000019b r8 : a6020b64
r7 : 00000000 r6 : 00000002 r5 : ffffffff r4 : ffffffff r3 : 00000000 r2 : 00000010 r1 : 2ac60000 r0 : a8334920
Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c53c7d Table: 3291804a DAC: 00000015 Process usbmgr (pid: 319, stack limit = 0xa843c210)

Stack: (0xa843de00 to 0xa843e000)

de00: 200f0013 a6020b64 00000002 ffffffff a6020b64 0000019b a843def8 80098810
de20: 00000010 8009ab24 a843de70 00000000 a843de70 8009896c 0000000e 00000000
de40: 00000000 00000000 800982dc a6020b64 00000002 00000001 00000001 a81b5e20
de60: a00f0193 000008e3 00000002 00000000 abb6a0a0 abc1b7c0 758045a0 80054b74
de80: 0000406f 8027ce94 a81b5c10 5355843b 00000000 00000001 00000001 00004000
dea0: 00000125 a81843c0 80ba11a8 a6020b64 a843def8 ffffffff 7fffffff 00000000
dec0: 00000000 00000000 758045a0 80098be8 a843ded0 a843ded0 a843ded8 a843ded8
dee0: a843dee0 a843dee0 a6020b64 a6020b64 00000001 8009064c 7fffffff 00000000
df00: 00000000 00000000 ffffffff 7fffffff 00000001 00000000 8000f684 a6020b64
df20: 00000081 ffffffff 7fffffff 8000f684 a843c000 800906ec ffffffff 7fffffff
df40: 00000001 a23b7c00 8000f684 a6020a00 00000081 80ba2ca4 a23b7c00 800cdf5c
df60: a3090c00 7f343ea4 80ba2ca4 800ce224 a2b06840 00000000 80ba2ca4 800e7aec
df80: a23b7f78 8003e124 a843c000 8000f684 a843dfb0 00000034 8000f684 80012000
dfa0: 758045a8 00000018 00000001 8000f54c 00000000 00000002 00000001 76f0dcfc
dfc0: 758045a8 00000018 00000001 00000034 aaaaaaab 00083d48 758045a0 758045a0
dfe0: 0009945c 7696dc0c 0006c31c 76b175bc 60010010 758045a8 00000000 00000000 [<80213708>] (__percpu_counter_add) from [<80098810>] (clear_page_dirty_for_io+0xc4/0xe0) [<80098810>] (clear_page_dirty_for_io) from [<8009896c>] (write_cache_pages+0x140/0x37c) [<8009896c>] (write_cache_pages) from [<80098be8>] (generic_writepages+0x40/0x60) [<80098be8>] (generic_writepages) from [<8009064c>] (__filemap_fdatawrite_range+0x64/0x6c) [<8009064c>] (__filemap_fdatawrite_range) from [<800906ec>] (filemap_write_and_wait+0x38/0x64) [<800906ec>] (filemap_write_and_wait) from [<800cdf5c>] (kill_block_super+0x20/0x68) [<800cdf5c>] (kill_block_super) from [<800ce224>] (deactivate_locked_super+0x58/0x7c) [<800ce224>] (deactivate_locked_super) from [<800e7aec>] (cleanup_mnt+0x38/0x7c) [<800e7aec>] (cleanup_mnt) from [<8003e124>] (task_work_run+0xac/0xe4) [<8003e124>] (task_work_run) from [<80012000>] (do_work_pending+0x7c/0xa4) [<80012000>] (do_work_pending) from [<8000f54c>] (work_pending+0xc/0x20)

Code: e5813004 e5903018 e1a07fc2 ee1d1f90 (e7933001)
---[ end trace 4b693779c2eb6edd ]---

---
 lib/percpu_counter.c | 5 +++++
 1 file changed, 5 insertions(+)

index f051d69..4e8c163 100644
@@ -77,6 +77,10 @@ void __percpu_counter_add(struct percpu_counter *fbc, s64 amount, s32 batch)
 	s64 count;
 
 	preempt_disable();
+
+	if (unlikely(!fbc->counters))
+		goto out;
+
 	count = __this_cpu_read(*fbc->counters) + amount;
 	if (count >= batch || count <= -batch) {
 		unsigned long flags;

@@ -87,6 +91,7 @@ void __percpu_counter_add(struct percpu_counter *fbc, s64 amount, s32 batch)
 	} else {
 		this_cpu_add(*fbc->counters, amount);
 	}
+out:
 	preempt_enable();
 }
 EXPORT_SYMBOL(__percpu_counter_add);

2.1.4