From patchwork Wed Sep 23 04:42:00 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Williams X-Patchwork-Id: 7247281 Return-Path: X-Original-To: patchwork-linux-nvdimm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 59290BEEC1 for ; Wed, 23 Sep 2015 04:47:46 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 75697206F3 for ; Wed, 23 Sep 2015 04:47:45 +0000 (UTC) Received: from ml01.01.org (ml01.01.org [198.145.21.10]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 5E3DE206DE for ; Wed, 23 Sep 2015 04:47:44 +0000 (UTC) Received: from ml01.vlan14.01.org (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 50BFA6154C; Tue, 22 Sep 2015 21:47:44 -0700 (PDT) X-Original-To: linux-nvdimm@lists.01.org Delivered-To: linux-nvdimm@lists.01.org Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by ml01.01.org (Postfix) with ESMTP id A3A8761525 for ; Tue, 22 Sep 2015 21:47:43 -0700 (PDT) Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga103.jf.intel.com with ESMTP; 22 Sep 2015 21:47:43 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.17,576,1437462000"; d="scan'208";a="811033831" Received: from dwillia2-desk3.jf.intel.com ([10.54.39.39]) by orsmga002.jf.intel.com with ESMTP; 22 Sep 2015 21:47:43 -0700 Subject: [PATCH 09/15] block, pmem: fix null pointer de-reference on shutdown, check for queue death From: Dan Williams To: akpm@linux-foundation.org Date: Wed, 23 Sep 2015 00:42:00 -0400 Message-ID: <20150923044200.36490.54494.stgit@dwillia2-desk3.jf.intel.com> In-Reply-To: <20150923043737.36490.70547.stgit@dwillia2-desk3.jf.intel.com> References: <20150923043737.36490.70547.stgit@dwillia2-desk3.jf.intel.com> User-Agent: StGit/0.17.1-9-g687f MIME-Version: 1.0 Cc: Jens Axboe , linux-nvdimm@lists.01.org, Dave Chinner , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, Christoph Hellwig X-BeenThere: linux-nvdimm@lists.01.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Linux-nvdimm developer list." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: linux-nvdimm-bounces@lists.01.org Sender: "Linux-nvdimm" X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_LOW, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP After the driver has been unbound the queue is dead and the private data pointer is invalid. Check that the queue is still alive, or otherwise pin it active before using queuedata. Fixes crash signatures like the following. BUG: unable to handle kernel paging request at ffff880140000000 [..] Call Trace: [] ? copy_user_handle_tail+0x5f/0x70 [] pmem_do_bvec.isra.11+0x70/0xf0 [nd_pmem] [] pmem_make_request+0xd1/0x200 [nd_pmem] [] ? mempool_alloc+0x72/0x1a0 [] generic_make_request+0xd6/0x110 [] submit_bio+0x76/0x170 [] submit_bh_wbc+0x12f/0x160 [] submit_bh+0x12/0x20 [] jbd2_write_superblock+0x8d/0x170 [] jbd2_mark_journal_empty+0x5d/0x90 [] jbd2_journal_destroy+0x24b/0x270 [] ? put_pwq_unlocked+0x2a/0x30 [] ? destroy_workqueue+0x225/0x250 [] ext4_put_super+0x64/0x360 [] generic_shutdown_super+0x6a/0xf0 Cc: Jens Axboe Cc: Christoph Hellwig Cc: Dave Chinner Cc: Ross Zwisler Signed-off-by: Dan Williams --- block/blk-core.c | 2 ++ drivers/nvdimm/pmem.c | 8 ++++++++ 2 files changed, 10 insertions(+) diff --git a/block/blk-core.c b/block/blk-core.c index 13764f8b22e0..0ea7d285b886 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -532,11 +532,13 @@ int blk_dax_get(struct request_queue *q) { return blk_qref_enter(&q->dax_ref, GFP_NOWAIT); } +EXPORT_SYMBOL(blk_dax_get); void blk_dax_put(struct request_queue *q) { percpu_ref_put(&q->dax_ref.count); } +EXPORT_SYMBOL(blk_dax_put); static void blk_dax_freeze(struct request_queue *q) { diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c index a01611d8f351..3ee02af73ad0 100644 --- a/drivers/nvdimm/pmem.c +++ b/drivers/nvdimm/pmem.c @@ -73,6 +73,12 @@ static void pmem_make_request(struct request_queue *q, struct bio *bio) struct block_device *bdev = bio->bi_bdev; struct pmem_device *pmem = bdev->bd_disk->private_data; + if (blk_dax_get(q) != 0) { + bio->bi_error = -ENODEV; + bio_endio(bio); + return; + } + do_acct = nd_iostat_start(bio, &start); bio_for_each_segment(bvec, bio, iter) pmem_do_bvec(pmem, bvec.bv_page, bvec.bv_len, bvec.bv_offset, @@ -84,6 +90,8 @@ static void pmem_make_request(struct request_queue *q, struct bio *bio) wmb_pmem(); bio_endio(bio); + + blk_dax_put(q); } static int pmem_rw_page(struct block_device *bdev, sector_t sector,