Patch "bcache: fix crashes in duplicate cache device register" has been added to the 4.9-stable tree
Subsystems (2)
This is a note to let you know that I've just added the patch titled
bcache: fix crashes in duplicate cache device register
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
bcache-fix-crashes-in-duplicate-cache-device-register.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
cc40daf91bdddbba72a4a8cd0860640e06668309Mon Sep 17 00:00:00 2001
From: Tang Junhui <[email protected]>
Date: Mon, 5 Mar 2018 13:41:54 -0800
Subject: bcache: fix crashes in duplicate cache device register
From: Tang Junhui <[email protected]>
commit cc40daf91bdddbba72a4a8cd0860640e06668309 upstream.
Kernel crashed when register a duplicate cache device, the call trace is bellow:
[ 417.643790] CPU: 1 PID: 16886 Comm: bcache-register Tainted: G W OE 4.15.5-amd64-preempt-sysrq-20171018 #2 [ 417.643861] Hardware name: LENOVO 20ERCTO1WW/20ERCTO1WW, BIOS N1DET41W (1.15 ) 12/31/2015 [ 417.643870] RIP: 0010:bdevname+0x13/0x1e [ 417.643876] RSP: 0018:ffffa3aa9138fd38 EFLAGS: 00010282 [ 417.643884] RAX: 0000000000000000 RBX: ffff8c8f2f2f8000 RCX: ffffd6701f8 c7edf [ 417.643890] RDX: ffffa3aa9138fd88 RSI: ffffa3aa9138fd88 RDI: 00000000000 00000 [ 417.643895] RBP: ffffa3aa9138fde0 R08: ffffa3aa9138fae8 R09: 00000000000 1850e [ 417.643901] R10: ffff8c8eed34b271 R11: ffff8c8eed34b250 R12: 00000000000 00000 [ 417.643906] R13: ffffd6701f78f940 R14: ffff8c8f38f80000 R15: ffff8c8ea7d 90000 [ 417.643913] FS: 00007fde7e66f500(0000) GS:ffff8c8f61440000(0000) knlGS: 0000000000000000 [ 417.643919] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 417.643925] CR2: 0000000000000314 CR3: 00000007e6fa0001 CR4: 00000000003 606e0 [ 417.643931] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000 00000 [ 417.643938] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000 00400 [ 417.643946] Call Trace: [ 417.643978] register_bcache+0x1117/0x1270 [bcache] [ 417.643994] ? slab_pre_alloc_hook+0x15/0x3c [ 417.644001] ? slab_post_alloc_hook.isra.44+0xa/0x1a [ 417.644013] ? kernfs_fop_write+0xf6/0x138 [ 417.644020] kernfs_fop_write+0xf6/0x138 [ 417.644031] __vfs_write+0x31/0xcc [ 417.644043] ? current_kernel_time64+0x10/0x36 [ 417.644115] ? __audit_syscall_entry+0xbf/0xe3 [ 417.644124] vfs_write+0xa5/0xe2 [ 417.644133] SyS_write+0x5c/0x9f [ 417.644144] do_syscall_64+0x72/0x81 [ 417.644161] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 417.644169] RIP: 0033:0x7fde7e1c1974 [ 417.644175] RSP: 002b:00007fff13009a38 EFLAGS: 00000246 ORIG_RAX: 0000000 000000001 [ 417.644183] RAX: ffffffffffffffda RBX: 0000000001658280 RCX: 00007fde7e1c 1974 [ 417.644188] RDX: 000000000000000a RSI: 0000000001658280 RDI: 000000000000 0001 [ 417.644193] RBP: 000000000000000a R08: 0000000000000003 R09: 000000000000 0077 [ 417.644198] R10: 000000000000089e R11: 0000000000000246 R12: 000000000000 0001 [ 417.644203] R13: 000000000000000a R14: 7fffffffffffffff R15: 000000000000 0000 [ 417.644213] Code: c7 c2 83 6f ee 98 be 20 00 00 00 48 89 df e8 6c 27 3b 0 0 48 89 d8 5b c3 0f 1f 44 00 00 48 8b 47 70 48 89 f2 48 8b bf 80 00 00 00 <8 b> b0 14 03 00 00 e9 73 ff ff ff 0f 1f 44 00 00 48 8b 47 40 39 [ 417.644302] RIP: bdevname+0x13/0x1e RSP: ffffa3aa9138fd38 [ 417.644306] CR2: 0000000000000314
When registering duplicate cache device in register_cache(), after failure on calling register_cache_set(), bch_cache_release() will be called, then bdev will be freed, so bdevname(bdev, name) caused kernel crash.
Since bch_cache_release() will free bdev, so in this patch we make sure bdev being freed if register_cache() fail, and do not free bdev again in register_bcache() when register_cache() fail.
--- drivers/md/bcache/super.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/md/bcache/super.c +10 -6
@@ -1182,7 +1182,7 @@ static void register_bdev(struct cache_sreturn ; err: -pr_notice ("error opening %s: %s" ,bdevname (bdev, name), err); +pr_notice ("error %s: %s" ,bdevname (bdev, name), err);bcache_device_stop (&dc->disk); }
@@ -1853,6 +1853,8 @@ static int register_cache(struct cache_sconst char *err =NULL ;/* must be set for any error case */ int ret =0 ; +bdevname (bdev, name); +memcpy (&ca->sb, sb,sizeof (struct cache_sb )); ca->bdev = bdev; ca->bdev->bd_holder = ca;
@@ -1863,11 +1865,12 @@ static int register_cache(struct cache_s ca->sb_bio.bi_io_vec[0 ].bv_page = sb_page;get_page (sb_page); -if (blk_queue_discard (bdev_get_queue (ca->bdev))) +if (blk_queue_discard (bdev_get_queue (bdev))) ca->discard =CACHE_DISCARD (&ca->sb); ret =cache_alloc (ca);if (ret !=0 ) { +blkdev_put (bdev,FMODE_READ |FMODE_WRITE |FMODE_EXCL );if (ret == -ENOMEM ) err ="cache_alloc(): -ENOMEM" ;else
@@ -1890,14 +1893,14 @@ static int register_cache(struct cache_s goto out; } -pr_info ("registered cache device %s" ,bdevname (bdev, name)); +pr_info ("registered cache device %s" , name); out:kobject_put (&ca->kobj); err:if (err) -pr_notice ("error opening %s: %s" ,bdevname (bdev, name), err); +pr_notice ("error %s: %s" , name, err);return ret; }
@@ -1986,6 +1989,7 @@ static ssize_t register_bcache(struct koif (err) goto err_close; + err ="failed to register device" ;if (SB_IS_BDEV (sb)) {struct cached_dev *dc =kzalloc (sizeof (*dc),GFP_KERNEL );if (!dc)
@@ -2000,7 +2004,7 @@ static ssize_t register_bcache(struct ko goto err_close;if (register_cache (sb, sb_page, bdev, ca) !=0 ) - goto err_close; + goto err; } out:if (sb_page)
@@ -2013,7 +2017,7 @@ out: err_close:blkdev_put (bdev,FMODE_READ |FMODE_WRITE |FMODE_EXCL ); err: -pr_info ("error opening %s: %s" , path, err); +pr_info ("error %s: %s" , path, err); ret = -EINVAL ; goto out; }
Patches currently in stable-queue which might be from [email protected] are
queue-4.9/bcache-fix-crashes-in-duplicate-cache-device-register.patch queue-4.9/bcache-don-t-attach-backing-with-duplicate-uuid.patch