Song Liu 6b55908db3 md/raid5: fix oops during stripe resizing ...

commit b44c018cdf upstream.

KoWei reported crash during raid5 reshape:

[ 1032.252932] Oops: 0002 [#1] SMP PTI
[...]
[ 1032.252943] RIP: 0010:memcpy_erms+0x6/0x10
[...]
[ 1032.252947] RSP: 0018:ffffba1ac0c03b78 EFLAGS: 00010286
[ 1032.252949] RAX: 0000784ac0000000 RBX: ffff91bec3d09740 RCX: 0000000000001000
[ 1032.252951] RDX: 0000000000001000 RSI: ffff91be6781c000 RDI: 0000784ac0000000
[ 1032.252953] RBP: ffffba1ac0c03bd8 R08: 0000000000001000 R09: ffffba1ac0c03bf8
[ 1032.252954] R10: 0000000000000000 R11: 0000000000000000 R12: ffffba1ac0c03bf8
[ 1032.252955] R13: 0000000000001000 R14: 0000000000000000 R15: 0000000000000000
[ 1032.252958] FS:  0000000000000000(0000) GS:ffff91becf500000(0000) knlGS:0000000000000000
[ 1032.252959] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1032.252961] CR2: 0000784ac0000000 CR3: 000000031780a002 CR4: 00000000001606e0
[ 1032.252962] Call Trace:
[ 1032.252969]  ? async_memcpy+0x179/0x1000 [async_memcpy]
[ 1032.252977]  ? raid5_release_stripe+0x8e/0x110 [raid456]
[ 1032.252982]  handle_stripe_expansion+0x15a/0x1f0 [raid456]
[ 1032.252988]  handle_stripe+0x592/0x1270 [raid456]
[ 1032.252993]  handle_active_stripes.isra.0+0x3cb/0x5a0 [raid456]
[ 1032.252999]  raid5d+0x35c/0x550 [raid456]
[ 1032.253002]  ? schedule+0x42/0xb0
[ 1032.253006]  ? schedule_timeout+0x10e/0x160
[ 1032.253011]  md_thread+0x97/0x160
[ 1032.253015]  ? wait_woken+0x80/0x80
[ 1032.253019]  kthread+0x104/0x140
[ 1032.253022]  ? md_start_sync+0x60/0x60
[ 1032.253024]  ? kthread_park+0x90/0x90
[ 1032.253027]  ret_from_fork+0x35/0x40

This is because cache_size_mutex was unlocked too early in resize_stripes,
which races with grow_one_stripe() that grow_one_stripe() allocates a
stripe with wrong pool_size.

Fix this issue by unlocking cache_size_mutex after updating pool_size.

Cc: <stable@vger.kernel.org> # v4.4+
Reported-by: KoWei Sung <winders@amazon.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-05-16 09:45:03 +09:00

..

bcache

bcache: fix a lost wake-up problem caused by mca_cannibalize_lock

2023-05-16 09:15:02 +09:00

persistent-data

dm space map common: fix to ensure new block isn't already in use

2023-05-15 16:55:48 +09:00

bitmap.c

md/bitmap: md_bitmap_get_counter returns wrong blocks

2023-05-16 09:44:51 +09:00

bitmap.h

md-cluster: sync bitmap when node received RESYNCING msg

2016-05-04 12:39:35 -07:00

dm-android-verity.c

md: High security vulnerability in dm-anroid-verity [1/1]

2020-12-17 17:19:05 +09:00

dm-android-verity.h

ANDROID: dm: rebase for 4.9

2017-01-31 10:45:54 -08:00

dm-bio-prison.c

dm: Use kzalloc for all structs with embedded biosets/mempools

2023-05-15 14:54:47 +09:00

dm-bio-prison.h

dm bio prison: add dm_cell_promote_or_release()

2015-05-29 14:19:06 -04:00

dm-bio-record.h

dm: Refactor for new bio cloning/splitting

2013-11-23 22:33:55 -08:00

dm-bufio.c

Revert "dm bufio: fix deadlock with loop device"

2023-05-15 14:21:02 +09:00

dm-bufio.h

dm snapshot: use dm-bufio prefetch

2014-01-14 23:23:03 -05:00

dm-builtin.c

dm: move request-based code out to dm-rq.[hc]

2016-06-10 15:15:44 -04:00

dm-cache-block-types.h

dm cache: revert "remove remainder of distinct discard block size"

2014-11-10 15:25:30 -05:00

dm-cache-metadata.c

dm cache metadata: Avoid returning cmd->bm wild pointer on error

2023-05-16 09:05:00 +09:00

dm-cache-metadata.h

dm cache: make sure every metadata function checks fail_io

2016-03-10 17:12:12 -05:00

dm-cache-policy-cleaner.c

dm cache: speed up writing of the hint array

2016-09-22 11:15:02 -04:00

dm-cache-policy-internal.h

dm cache: speed up writing of the hint array

2016-09-22 11:15:02 -04:00

dm-cache-policy-smq.c

dm cache policy smq: distribute entries to random levels when switching to smq

2016-09-22 11:15:03 -04:00

dm-cache-policy.c

dm cache: add policy name to status output

2014-01-16 13:44:11 -05:00

dm-cache-policy.h

dm cache: speed up writing of the hint array

2016-09-22 11:15:02 -04:00

dm-cache-target.c

dm cache: fix a crash due to incorrect work item cancelling

2023-05-15 17:03:20 +09:00

dm-core.h

dm: allocate struct mapped_device with kvzalloc

2017-11-30 08:39:02 +00:00

dm-crypt.c

Merge tag 'v4.9.6' into android-4.9

2017-01-31 13:55:27 -08:00

dm-delay.c

dm delay: fix a crash when invalid device is specified

2023-05-15 12:53:20 +09:00

dm-era-target.c

dm era: save spacemap metadata root after the pre-commit

2017-05-20 14:28:37 +02:00

dm-exception-store.c

Merge tag 'dm-4.4-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

2015-11-04 21:19:53 -08:00

dm-exception-store.h

dm snapshot: fix hung bios when copy error occurs

2016-01-08 20:03:05 -05:00

dm-flakey.c

dm flakey: check for null arg_name in parse_features()

2023-05-15 17:15:29 +09:00

dm-io.c

dm: Use kzalloc for all structs with embedded biosets/mempools

2023-05-15 14:54:47 +09:00

dm-ioctl.c

dm ioctl: harden copy_params()'s copy_from_user() from malicious users

2023-05-15 09:22:57 +09:00

dm-kcopyd.c

dm: Use kzalloc for all structs with embedded biosets/mempools

2023-05-15 14:54:47 +09:00

dm-linear.c

ANDROID: dm: rebase for 4.9

2017-01-31 10:45:54 -08:00

dm-log-userspace-base.c

dm: drop NULL test before kmem_cache_destroy() and mempool_destroy()

2015-10-31 19:06:00 -04:00

dm-log-userspace-transfer.c

dm log userspace transfer: match wait_for_completion_timeout return type

2015-04-15 12:10:20 -04:00

dm-log-userspace-transfer.h

…

dm-log-writes.c

Merge branch 'for-4.9/block' of git://git.kernel.dk/linux-block

2016-10-07 14:42:05 -07:00

dm-log.c

dm log: fix unitialized bio operation flags

2016-08-24 21:55:05 -04:00

dm-mpath.c

dm mpath: cleanup -Wbool-operation warning in choose_pgpath()

2017-07-27 15:07:55 -07:00

dm-mpath.h

…

dm-path-selector.c

md: Add module.h to all files using it implicitly

2011-10-31 19:31:18 -04:00

dm-path-selector.h

dm path selector: remove 'repeat_count' return from .select_path hook

2016-02-22 22:34:42 -05:00

dm-queue-length.c

dm path selector: remove 'repeat_count' return from .select_path hook

2016-02-22 22:34:42 -05:00

dm-raid1.c

dm mirror: use all available legs on multiple failures

2016-10-14 11:55:17 -04:00

dm-raid.c

dm raid: fix rebuild of specific devices by updating superblock

2023-05-15 08:34:02 +09:00

dm-region-hash.c

dm: Use kzalloc for all structs with embedded biosets/mempools

2023-05-15 14:54:47 +09:00

dm-round-robin.c

dm round robin: revert "use percpu 'repeat_count' and 'current_path'"

2017-03-12 06:41:44 +01:00

dm-rq.c

dm rq: check blk_mq_register_dev() return value in dm_mq_init_request_queue()

2017-05-20 14:28:37 +02:00

dm-rq.h

dm rq: introduce dm_mq_kick_requeue_list()

2016-09-15 11:16:05 -04:00

dm-service-time.c

dm path selector: remove 'repeat_count' return from .select_path hook

2016-02-22 22:34:42 -05:00

dm-snap-persistent.c

block: fix an integer overflow in logical block size

2023-05-15 16:34:53 +09:00

dm-snap-transient.c

dm snapshot: fix hung bios when copy error occurs

2016-01-08 20:03:05 -05:00

dm-snap.c

dm: Use kzalloc for all structs with embedded biosets/mempools

2023-05-15 14:54:47 +09:00

dm-stats.c

dm stats: fix a leaked s->histogram_boundaries array

2017-03-12 06:41:44 +01:00

dm-stats.h

dm stats: support precise timestamps

2015-06-17 12:40:40 -04:00

dm-stripe.c

block: rename bio bi_rw to bi_opf

2016-08-07 14:41:02 -06:00

dm-switch.c

dm switch: simplify conditional in alloc_region_table()

2015-10-31 19:06:06 -04:00

dm-sysfs.c

dm: move request-based code out to dm-rq.[hc]

2016-06-10 15:15:44 -04:00

dm-table.c

overflow.h: Add allocation size calculation helpers

2023-05-16 08:57:52 +09:00

dm-target.c

Merge tag 'libnvdimm-for-4.8' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm

2016-07-28 17:38:16 -07:00

dm-thin-metadata.c

dm thin metadata: Avoid returning cmd->bm wild pointer on error

2023-05-16 09:05:01 +09:00

dm-thin-metadata.h

dm thin: fix passdown_double_checking_shared_status()

2023-05-15 11:10:19 +09:00

dm-thin.c

dm: Use kzalloc for all structs with embedded biosets/mempools

2023-05-15 14:54:47 +09:00

dm-uevent.c

md: Add in export.h for files using EXPORT_SYMBOL

2011-10-31 19:31:19 -04:00

dm-uevent.h

…

dm-verity-avb.c

ANDROID: AVB2: Enable avb2 driver [3/6]

2018-07-09 11:31:20 +08:00

dm-verity-fec.c

dm verity fec: fix hash block number in verity_fec_decode

2023-05-15 17:24:43 +09:00

dm-verity-fec.h

dm verity fec: limit error correction recursion

2017-04-12 12:41:12 +02:00

dm-verity-target.c

dm verity: use message limit for data block corruption message

2023-05-15 13:59:09 +09:00

dm-verity.h

ANDROID: AVB2: Enable avb2 driver [3/6]

2018-07-09 11:31:20 +08:00

dm-zero.c

block: rename bio bi_rw to bi_opf

2016-08-07 14:41:02 -06:00

dm.c

dm: fix potential for q->make_request_fn NULL pointer

2023-05-15 16:57:22 +09:00

dm.h

ANDROID: Update init/do_mounts_dm.c to the latest ChromiumOS version.

2017-06-05 11:26:17 -04:00

faulty.c

MD: rename some functions

2016-01-20 13:52:20 -08:00

Kconfig

md: High security vulnerability in dm-anroid-verity [1/1]

2020-12-17 17:19:05 +09:00

linear.c

md/linear: shutup lockdep warnning

2017-10-21 17:21:35 +02:00

linear.h

md linear: fix a race between linear_add() and linear_congested()

2017-03-12 06:41:52 +01:00

Makefile

ANDROID: AVB2: Enable avb2 driver [3/6]

2018-07-09 11:31:20 +08:00

md-cluster.c

md-cluster: fix wild pointer of unlock_all_bitmaps()

2023-05-16 08:45:55 +09:00

md-cluster.h

md-cluster: gather resync infos and enable recv_thread after bitmap is ready

2016-05-09 09:24:03 -07:00

md.c

md: don't flush workqueue unconditionally in md_open

2023-05-15 17:33:47 +09:00

md.h

md: changes for MD_STILL_CLOSED flag

2016-09-21 09:09:44 -07:00

multipath.c

block: rename bio bi_rw to bi_opf

2016-08-07 14:41:02 -06:00

multipath.h

md/multipath: typedef removal: multipath_conf_t -> struct mpconf

2011-10-11 16:48:57 +11:00

raid0.c

block: fix an integer overflow in logical block size

2023-05-15 16:34:53 +09:00

raid0.h

block: kill merge_bvec_fn() completely

2015-08-13 12:31:57 -06:00

raid1.c

md: raid1: check rdev before reference in raid1_sync_request func

2023-05-15 16:30:05 +09:00

raid1.h

md-cluster: Use a small window for resync

2015-10-12 01:32:05 -05:00

raid5-cache.c

raid5-cache: correct condition for empty metadata write

2016-10-28 22:04:03 -07:00

raid5.c

md/raid5: fix oops during stripe resizing

2023-05-16 09:45:03 +09:00

raid5.h

md/raid5: Convert to hotplug state machine

2016-09-06 18:30:23 +02:00

raid10.c

md: Fix failed allocation of md_register_thread

2023-05-15 12:06:40 +09:00

raid10.h

raid10: improve random reads performance

2016-07-19 15:20:28 -07:00