linux-stable.git/drivers/md/bcache, branch v3.16.35

bcache: fix cache_set_flush() NULL pointer dereference on OOM

2016-04-30T22:05:56+00:00

commit f8b11260a445169989d01df75d35af0f56178f95 upstream.

When bch_cache_set_alloc() fails to kzalloc the cache_set, the
asyncronous closure handling tries to dereference a cache_set that
hadn't yet been allocated inside of cache_set_flush() which is called
by __cache_set_unregister() during cleanup.  This appears to happen only
during an OOM condition on bcache_register.

Signed-off-by: Eric Wheeler 
Signed-off-by: Ben Hutchings

bcache: cleaned up error handling around register_cache()

2016-04-30T22:05:56+00:00

commit 9b299728ed777428b3908ac72ace5f8f84b97789 upstream.

Fix null pointer dereference by changing register_cache() to return an int
instead of being void.  This allows it to return -ENOMEM or -ENODEV and
enables upper layers to handle the OOM case without NULL pointer issues.

See this thread:
  http://thread.gmane.org/gmane.linux.kernel.bcache.devel/3521

Fixes this error:
  gargamel:/sys/block/md5/bcache# echo /dev/sdh2 > /sys/fs/bcache/register

  bcache: register_cache() error opening sdh2: cannot allocate memory
  BUG: unable to handle kernel NULL pointer dereference at 00000000000009b8
  IP: [] cache_set_flush+0x102/0x15c [bcache]
  PGD 120dff067 PUD 1119a3067 PMD 0
  Oops: 0000 [#1] SMP
  Modules linked in: veth ip6table_filter ip6_tables
  (...)
  CPU: 4 PID: 3371 Comm: kworker/4:3 Not tainted 4.4.2-amd64-i915-volpreempt-20160213bc1 #3
  Hardware name: System manufacturer System Product Name/P8H67-M PRO, BIOS 3904 04/27/2013
  Workqueue: events cache_set_flush [bcache]
  task: ffff88020d5dc280 ti: ffff88020b6f8000 task.ti: ffff88020b6f8000
  RIP: 0010:[]  [] cache_set_flush+0x102/0x15c [bcache]

Signed-off-by: Eric Wheeler 
Tested-by: Marc MERLIN 
Signed-off-by: Ben Hutchings

bcache: Fix more early shutdown bugs

2016-04-30T22:05:55+00:00

commit d83353b319d47ef8cce82467da6a25c2d558253f upstream.

Signed-off-by: Kent Overstreet 
Signed-off-by: Ben Hutchings

bcache: add mutex lock for bch_is_open

2016-03-24T10:01:17+00:00

commit 789d21dbd9d8889e62c79ec19585fcc97e42ef07 upstream.

Since bch_is_open will iterate linked list bch_cache_sets and
uncached_devices, it needs bch_register_lock.

Signed-off-by: Jianjian Huo 
Cc: Kamal Mostafa 
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques

bcache: Change refill_dirty() to always scan entire disk if necessary

2016-02-02T19:09:12+00:00

commit 627ccd20b4ad3ba836472468208e2ac4dfadbf03 upstream.

Previously, it would only scan the entire disk if it was starting from
the very start of the disk - i.e. if the previous scan got to the end.

This was broken by refill_full_stripes(), which updates last_scanned so
that refill_dirty was never triggering the searched_from_start path.

But if we change refill_dirty() to always scan the entire disk if
necessary, regardless of what last_scanned was, the code gets cleaner
and we fix that bug too.

Signed-off-by: Kent Overstreet 
Signed-off-by: Jens Axboe 
Signed-off-by: Luis Henriques

bcache: prevent crash on changing writeback_running

2016-02-02T19:09:12+00:00

commit 8d16ce540c94c9d366eb36fc91b7154d92d6397b upstream.

Added a safeguard in the shutdown case. At least while not being
attached it is also possible to trigger a kernel bug by writing into
writeback_running. This change  adds the same check before trying to
wake up the thread for that case.

Signed-off-by: Stefan Bader 
Cc: Kent Overstreet 
Signed-off-by: Jens Axboe 
Signed-off-by: Luis Henriques

bcache: allows use of register in udev to avoid "device_busy" error.

2016-02-02T19:09:11+00:00

commit d7076f21629f8f329bca4a44dc408d94670f49e2 upstream.

Allows to use register, not register_quiet in udev to avoid "device_busy" error.
The initial patch proposed at https://lkml.org/lkml/2013/8/26/549 by Gabriel de Perthuis
 does not unlock the mutex and hangs the kernel.

See http://thread.gmane.org/gmane.linux.kernel.bcache.devel/2594 for the discussion.

Cc: Denis Bychkov 
Cc: Kent Overstreet 
Cc: Eric Wheeler 
Cc: Gabriel de Perthuis 

Signed-off-by: Jens Axboe 
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques

bcache: unregister reboot notifier if bcache fails to unregister device

2016-02-02T19:09:10+00:00

commit 2ecf0cdb2b437402110ab57546e02abfa68a716b upstream.

In bcache_init() function it forgot to unregister reboot notifier if
bcache fails to unregister a block device.  This commit fixes this.

Signed-off-by: Zheng Liu 
Tested-by: Joshua Schmid 
Tested-by: Eric Wheeler 
Cc: Kent Overstreet 
Signed-off-by: Jens Axboe 
Signed-off-by: Luis Henriques

bcache: fix a leak in bch_cached_dev_run()

2016-02-02T19:09:09+00:00

commit 4d4d8573a8451acc9f01cbea24b7e55f04a252fe upstream.

Signed-off-by: Al Viro 
Tested-by: Joshua Schmid 
Tested-by: Eric Wheeler 
Cc: Kent Overstreet 
Signed-off-by: Jens Axboe 
Signed-off-by: Luis Henriques

bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device

2016-02-02T19:09:08+00:00

commit fecaee6f20ee122ad75402c53d8278f9bb142ddc upstream.

This bug can be reproduced by the following script:

  #!/bin/bash

  bcache_sysfs="/sys/fs/bcache"

  function clear_cache()
  {
  	if [ ! -e $bcache_sysfs ]; then
  		echo "no bcache sysfs"
  		exit
  	fi

  	cset_uuid=$(ls -l $bcache_sysfs|head -n 2|tail -n 1|awk '{print $9}')
  	sudo sh -c "echo $cset_uuid > /sys/block/sdb/sdb1/bcache/detach"
  	sleep 5
  	sudo sh -c "echo $cset_uuid > /sys/block/sdb/sdb1/bcache/attach"
  }

  for ((i=0;i<10;i++)); do
  	clear_cache
  done

The warning messages look like below:
[  275.948611] ------------[ cut here ]------------
[  275.963840] WARNING: at fs/sysfs/dir.c:512 sysfs_add_one+0xb8/0xd0() (Tainted: P        W
---------------   )
[  275.979253] Hardware name: Tecal RH2285
[  275.994106] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:09.0/0000:08:00.0/host4/target4:2:1/4:2:1:0/block/sdb/sdb1/bcache/cache'
[  276.024105] Modules linked in: bcache tcp_diag inet_diag ipmi_devintf ipmi_si ipmi_msghandler
bonding 8021q garp stp llc ipv6 ext3 jbd loop sg iomemory_vsl(P) bnx2 microcode serio_raw i2c_i801
i2c_core iTCO_wdt iTCO_vendor_support i7core_edac edac_core shpchp ext4 jbd2 mbcache megaraid_sas
pata_acpi ata_generic ata_piix dm_mod [last unloaded: scsi_wait_scan]
[  276.072643] Pid: 2765, comm: sh Tainted: P        W  ---------------    2.6.32 #1
[  276.089315] Call Trace:
[  276.105801]  [] ? warn_slowpath_common+0x87/0xc0
[  276.122650]  [] ? warn_slowpath_fmt+0x46/0x50
[  276.139361]  [] ? sysfs_add_one+0xb8/0xd0
[  276.156012]  [] ? sysfs_do_create_link+0x12b/0x170
[  276.172682]  [] ? sysfs_create_link+0x13/0x20
[  276.189282]  [] ? bcache_device_link+0xc1/0x110 [bcache]
[  276.205993]  [] ? bch_cached_dev_attach+0x478/0x4f0 [bcache]
[  276.222794]  [] ? bch_cached_dev_store+0x627/0x780 [bcache]
[  276.239680]  [] ? alloc_pages_current+0xaa/0x110
[  276.256594]  [] ? sysfs_write_file+0xe5/0x170
[  276.273364]  [] ? vfs_write+0xb8/0x1a0
[  276.290133]  [] ? sys_write+0x51/0x90
[  276.306368]  [] ? system_call_fastpath+0x16/0x1b
[  276.322301] ---[ end trace 9f5d4fcdd0c3edfb ]---
[  276.338241] ------------[ cut here ]------------
[  276.354109] WARNING: at /home/wenqing.lz/bcache/bcache/super.c:720
bcache_device_link+0xdf/0x110 [bcache]() (Tainted: P        W  ---------------   )
[  276.386017] Hardware name: Tecal RH2285
[  276.401430] Couldn't create device <-> cache set symlinks
[  276.401759] Modules linked in: bcache tcp_diag inet_diag ipmi_devintf ipmi_si ipmi_msghandler
bonding 8021q garp stp llc ipv6 ext3 jbd loop sg iomemory_vsl(P) bnx2 microcode serio_raw i2c_i801
i2c_core iTCO_wdt iTCO_vendor_support i7core_edac edac_core shpchp ext4 jbd2 mbcache megaraid_sas
pata_acpi ata_generic ata_piix dm_mod [last unloaded: scsi_wait_scan]
[  276.465477] Pid: 2765, comm: sh Tainted: P        W  ---------------    2.6.32 #1
[  276.482169] Call Trace:
[  276.498610]  [] ? warn_slowpath_common+0x87/0xc0
[  276.515405]  [] ? warn_slowpath_fmt+0x46/0x50
[  276.532059]  [] ? bcache_device_link+0xdf/0x110 [bcache]
[  276.548808]  [] ? bch_cached_dev_attach+0x478/0x4f0 [bcache]
[  276.565569]  [] ? bch_cached_dev_store+0x627/0x780 [bcache]
[  276.582418]  [] ? alloc_pages_current+0xaa/0x110
[  276.599341]  [] ? sysfs_write_file+0xe5/0x170
[  276.616142]  [] ? vfs_write+0xb8/0x1a0
[  276.632607]  [] ? sys_write+0x51/0x90
[  276.648671]  [] ? system_call_fastpath+0x16/0x1b
[  276.664756] ---[ end trace 9f5d4fcdd0c3edfc ]---

We forget to clear BCACHE_DEV_UNLINK_DONE flag in bcache_device_attach()
function when we attach a backing device first time.  After detaching this
backing device, this flag will be true and sysfs_remove_link() isn't called in
bcache_device_unlink().  Then when we attach this backing device again,
sysfs_create_link() will return EEXIST error in bcache_device_link().

So the fix is trival and we clear this flag in bcache_device_link().

Signed-off-by: Zheng Liu 
Tested-by: Joshua Schmid 
Tested-by: Eric Wheeler 
Cc: Kent Overstreet 
Signed-off-by: Jens Axboe 
Signed-off-by: Luis Henriques