lkml.org 
[lkml]   [2017]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL for 4.9 14/33] xfs: fix forgotten rcu read unlock when skipping inode reclaim
    Date
    From: "Darrick J. Wong" <darrick.wong@oracle.com>

    [ Upstream commit 962cc1ad6caddb5abbb9f0a43e5abe7131a71f18 ]

    In commit f2e9ad21 ("xfs: check for race with xfs_reclaim_inode"), we
    skip an inode if we're racing with freeing the inode via
    xfs_reclaim_inode, but we forgot to release the rcu read lock when
    dumping the inode, with the result that we exit to userspace with a lock
    held. Don't do that; generic/320 with a 1k block size fails this
    very occasionally.

    ================================================
    WARNING: lock held when returning to user space!
    4.14.0-rc6-djwong #4 Tainted: G W
    ------------------------------------------------
    rm/30466 is leaving the kernel with locks still held!
    1 lock held by rm/30466:
    #0: (rcu_read_lock){....}, at: [<ffffffffa01364d3>] xfs_ifree_cluster.isra.17+0x2c3/0x6f0 [xfs]
    ------------[ cut here ]------------
    WARNING: CPU: 1 PID: 30466 at kernel/rcu/tree_plugin.h:329 rcu_note_context_switch+0x71/0x700
    Modules linked in: deadline_iosched dm_snapshot dm_bufio ext4 mbcache jbd2 dm_flakey xfs libcrc32c dax_pmem device_dax nd_pmem sch_fq_codel af_packet [last unloaded: scsi_debug]
    CPU: 1 PID: 30466 Comm: rm Tainted: G W 4.14.0-rc6-djwong #4
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.10.2-1ubuntu1djwong0 04/01/2014
    task: ffff880037680000 task.stack: ffffc90001064000
    RIP: 0010:rcu_note_context_switch+0x71/0x700
    RSP: 0000:ffffc90001067e50 EFLAGS: 00010002
    RAX: 0000000000000001 RBX: ffff880037680000 RCX: ffff88003e73d200
    RDX: 0000000000000002 RSI: ffffffff819e53e9 RDI: ffffffff819f4375
    RBP: 0000000000000000 R08: 0000000000000000 R09: ffff880062c900d0
    R10: 0000000000000000 R11: 0000000000000000 R12: ffff880037680000
    R13: 0000000000000000 R14: ffffc90001067eb8 R15: ffff880037680690
    FS: 00007fa3b8ce8700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f69bf77c000 CR3: 000000002450a000 CR4: 00000000000006e0
    Call Trace:
    __schedule+0xb8/0xb10
    schedule+0x40/0x90
    exit_to_usermode_loop+0x6b/0xa0
    prepare_exit_to_usermode+0x7a/0x90
    retint_user+0x8/0x20
    RIP: 0033:0x7fa3b87fda87
    RSP: 002b:00007ffe41206568 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff02
    RAX: 0000000000000000 RBX: 00000000010e88c0 RCX: 00007fa3b87fda87
    RDX: 0000000000000000 RSI: 00000000010e89c8 RDI: 0000000000000005
    RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000
    R10: 000000000000015e R11: 0000000000000246 R12: 00000000010c8060
    R13: 00007ffe41206690 R14: 0000000000000000 R15: 0000000000000000
    ---[ end trace e88f83bf0cfbd07d ]---

    Fixes: f2e9ad212def50bcf4c098c6288779dd97fff0f0
    Cc: Omar Sandoval <osandov@fb.com>
    Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Reviewed-by: Omar Sandoval <osandov@fb.com>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    ---
    fs/xfs/xfs_inode.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
    index fe9a9a183b2d..98ca9f1b6a07 100644
    --- a/fs/xfs/xfs_inode.c
    +++ b/fs/xfs/xfs_inode.c
    @@ -2386,6 +2386,7 @@ retry:
    */
    if (ip->i_ino != inum + i) {
    xfs_iunlock(ip, XFS_ILOCK_EXCL);
    + rcu_read_unlock();
    continue;
    }
    }
    --
    2.11.0
    \
     
     \ /
      Last update: 2017-12-02 17:15    [W:4.380 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site