Theodore Ts'o
c2c814fc9a
memcg: fix a crash in wb_workfn when a device disappears ...
commit 68f23b89067fdf187763e75a56087550624fdbee upstream.
Without memcg, there is a one-to-one mapping between the bdi and
bdi_writeback structures. In this world, things are fairly
straightforward; the first thing bdi_unregister() does is to shutdown
the bdi_writeback structure (or wb), and part of that writeback ensures
that no other work queued against the wb, and that the wb is fully
drained.
With memcg, however, there is a one-to-many relationship between the bdi
and bdi_writeback structures; that is, there are multiple wb objects
which can all point to a single bdi. There is a refcount which prevents
the bdi object from being released (and hence, unregistered). So in
theory, the bdi_unregister() *should* only get called once its refcount
goes to zero (bdi_put will drop the refcount, and when it is zero,
release_bdi gets called, which calls bdi_unregister).
Unfortunately, del_gendisk() in block/gen_hd.c never got the memo about
the Brave New memcg World, and calls bdi_unregister directly. It does
this without informing the file system, or the memcg code, or anything
else. This causes the root wb associated with the bdi to be
unregistered, but none of the memcg-specific wb's are shutdown. So when
one of these wb's are woken up to do delayed work, they try to
dereference their wb->bdi->dev to fetch the device name, but
unfortunately bdi->dev is now NULL, thanks to the bdi_unregister()
called by del_gendisk(). As a result, *boom*.
Fortunately, it looks like the rest of the writeback path is perfectly
happy with bdi->dev and bdi->owner being NULL, so the simplest fix is to
create a bdi_dev_name() function which can handle bdi->dev being NULL.
This also allows us to bulletproof the writeback tracepoints to prevent
them from dereferencing a NULL pointer and crashing the kernel if one is
tracing with memcg's enabled, and an iSCSI device dies or a USB storage
stick is pulled.
The most common way of triggering this will be hotremoval of a device
while writeback with memcg enabled is going on. It was triggering
several times a day in a heavily loaded production environment.
Google Bug Id: 145475544
Link: https://lore.kernel.org/r/20191227194829.150110-1-tytso@mit.edu
Link: http://lkml.kernel.org/r/20191228005211.163952-1-tytso@mit.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: Chris Mason <clm@fb.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-11 04:35:11 -08:00
can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing CAN sk_buffs
2020-01-14 20:08:28 +01:00
net: dsa: sja1105: Fix sleeping while atomic in .port_hwtstamp_set
2019-10-02 12:19:53 -04:00
gpiolib: Initialize the hardware with a callback
2019-10-15 01:18:46 +02:00
chrome platform changes for v5.4
2019-09-19 14:14:28 -07:00
mfd: rk808: Fix RK818 ID template
2019-12-17 19:56:49 +01:00
net/mlx5: Fix flow counter list auto bits struct
2019-10-29 16:27:17 -07:00
mmc: sdio: fix wl1251 vendor id
2020-01-26 10:01:07 +01:00
This pull-request contains the following changes for MTD:
2019-09-21 10:59:54 -07:00
netfilter: nf_tables: autoload modules from the abort path
2020-01-29 16:45:33 +01:00
bus: ti-sysc: Fix missing force mstandby quirk handling
2020-02-01 09:34:51 +00:00
ARM: OMAP2+: SmartReflex: add omap_sr_pdata definition
2020-02-01 09:34:49 +00:00
RDMA subsystem updates for 5.4
2019-09-21 10:26:24 -07:00
regulator: ab8500: Remove SYSCLKREQ from enum ab8505_regulator_id
2020-01-23 08:23:00 +01:00
cpufreq: Avoid leaving stale IRQ work items during CPU offline
2019-12-31 16:46:06 +01:00
drm main pull for 5.4-rc1
2019-09-19 16:24:24 -07:00
SUNRPC: Destroy the back channel when we destroy the host transport
2019-10-30 12:04:35 -04:00
USB: serial: ir-usb: fix link-speed handling
2020-02-01 09:34:32 +00:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys()
2020-01-09 10:19:59 +01:00
memcg: fix a crash in wb_workfn when a device disappears
2020-02-11 04:35:11 -08:00
block: add bio_truncate to fix guard_bio_eod
2020-01-09 10:19:54 +01:00
bitmap.h: fix kernel-doc warning and typo
2019-10-14 15:04:01 -07:00
lib: introduce copy_struct_from_user() helper
2019-10-01 15:45:03 +02:00
block: fix an integer overflow in logical block size
2020-01-23 08:22:32 +01:00
bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}()
2019-10-31 21:41:33 +01:00
Merge branches 'clk-init-destroy', 'clk-doc', 'clk-imx' and 'clk-allwinner' into clk-next
2019-09-19 15:31:27 -07:00
We have a small collection of core framework updates this time, mostly around
2019-09-20 15:45:07 -07:00
mm, compaction: raise compaction priority after it withdrawns
2019-09-24 15:54:10 -07:00
futex: Move futex exit handling into futex code
2019-11-29 10:10:08 +01:00
compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use
2019-10-11 09:26:05 -07:00
Make use of gcc 9's "asm inline()" (Rasmus Villemoes):
2019-09-21 09:47:19 -07:00
cpu/speculation: Uninline and export CPU mitigations helpers
2019-11-04 12:22:02 +01:00
cpufreq: Avoid leaving stale IRQ work items during CPU offline
2019-12-31 16:46:06 +01:00
cpumask: nicer for_each_cpumask_and() signature
2019-09-25 17:51:40 -07:00
selinux/stable-5.4 PR 20190917
2019-09-23 11:21:04 -07:00
dma-direct: check for overflows on 32 bit DMA addresses
2020-01-04 19:17:24 +01:00
dma-mapping: fix handling of dma-ranges for reserved memory (again)
2020-01-04 19:17:00 +01:00
dmaengine: Fix access to uninitialized dma_slave_caps
2020-01-09 10:19:58 +01:00
dynamic_debug: provide dynamic_hex_dump stub
2019-10-22 12:54:44 -07:00
x86, efi: Never relocate kernel below lowest acceptable address
2019-10-31 09:40:19 +01:00
symbol namespaces: revert to previous __ksymtab name scheme
2019-10-18 15:32:52 +02:00
bpf: Fix use after free in subprog's jited symbol removal
2019-10-22 11:26:09 -07:00
compat_ioctl: add compat_ptr_ioctl()
2019-12-17 19:55:30 +01:00
fuse update for 5.4
2019-09-25 09:55:59 -07:00
futex: Add mutex around futex exit
2019-11-29 10:10:13 +01:00
net: fix sk_page_frag() recursion from memory reclaim
2019-10-28 16:17:31 -07:00
hrtimer: Annotate lockless access to timer->state
2020-01-04 19:18:41 +01:00
libnvdimm fixes v5.4-rc1
2019-09-29 10:33:41 -07:00
mm: introduce page_size()
2019-09-24 15:54:08 -07:00
hwmon: Fix HWMON_P_MIN_ALARM mask
2019-10-02 06:36:50 -07:00
- First round of vmbus hibernation support from Dexuan Cui.
2019-09-24 12:36:31 -07:00
Merge branch 'i2c/for-5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
2019-09-24 16:48:02 -07:00
XArray updates for 5.4
2019-11-08 08:46:49 -08:00
macvlan: do not assume mac_header is set in macvlan_broadcast()
2020-01-12 12:21:46 +01:00
net: remove unnecessary variables and callback
2019-10-24 14:53:49 -07:00
team: fix nested locking lockdep warning
2019-10-24 14:53:48 -07:00
net: remove unnecessary variables and callback
2019-10-24 14:53:49 -07:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros
2019-11-11 16:10:54 +01:00
augmented rbtree: add new RB_DECLARE_CALLBACKS_MAX macro
2019-09-25 17:51:39 -07:00
iomap: move the iomap_dio_rw ->end_io callback into a structure
2019-09-19 15:32:45 -07:00
ipmi: Don't allow device module unload when in use
2019-12-31 16:44:14 +01:00
jbd2: Fix possible overflow in jbd2_log_space_left()
2019-12-13 08:42:53 +01:00
kernfs: fix ino wrap-around detection
2019-12-13 08:42:53 +01:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
kgdb: don't use a notifier to enter kgdb at panic; call directly
2019-09-25 17:51:40 -07:00
khugepaged: enable collapse pmd for pte-mapped THP
2019-09-24 15:54:11 -07:00
Bugfixes: unwinding of KVM_CREATE_VM failure,
2019-11-12 13:19:15 -08:00
leds: core: Fix leds.h structure documentation
2019-10-08 22:05:58 +02:00
libata: Fix retrieving of active qcs
2020-01-09 10:19:59 +01:00
libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
2020-01-04 19:18:28 +01:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
mm, memcg: make scan aggression always exclude protection
2019-10-07 15:47:20 -07:00
mm/memory_hotplug: fix try_offline_node()
2019-11-15 18:34:00 -08:00
mm/memory_hotplug: shrink zones when offlining memory
2020-01-09 10:19:56 +01:00
Revert "Revert "mm, thp: restore node-local hugepage allocations""
2019-09-28 14:05:38 -07:00
libnvdimm fixes v5.4-rc1
2019-09-29 10:33:41 -07:00
net: phy: micrel: Update KSZ87xx PHY name
2019-10-17 16:31:52 -07:00
net: phy: fix write to mii-ctrl1000 register
2019-10-04 18:11:08 -07:00
rfkill: allocate static minor
2019-12-13 08:43:18 +01:00
mm, debug_pagealloc: don't rely on static keys too early
2020-01-23 08:22:40 +01:00
mm: thp: handle page cache THP correctly in PageTransCompoundMap
2019-11-06 08:28:58 -08:00
fork: improve error message for corrupted page tables
2019-09-25 17:51:40 -07:00
mm: memcg/slab: fix percpu slab vmstats flushing
2020-01-23 08:22:39 +01:00
mod_devicetable: fix PHY module format
2019-12-31 16:41:16 +01:00
Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
2019-09-27 19:37:27 -07:00
net: rtnetlink: validate IFLA_MTU attribute in rtnl_create_link()
2020-01-29 16:45:21 +01:00
NFS: Refactor nfs_instantiate() for dentry referencing callers
2019-09-20 15:15:24 -04:00
nvme_fc: add module to ops template to allow module references
2020-01-09 10:19:41 +01:00
nvme: introduce "Command Aborted By host" status code
2019-12-31 16:44:40 +01:00
nvmem: core: fix nvmem_cell_write inline function
2019-12-31 16:44:43 +01:00
mm: thp: handle page cache THP correctly in PageTransCompoundMap
2019-11-06 08:28:58 -08:00
mm, page_owner: rename flag indicating that page is allocated
2019-10-14 15:04:00 -07:00
mm: page cache: store only head pages in i_pages
2019-09-24 15:54:08 -07:00
PCI: Fix missing inline for pci_pr3_present()
2020-01-09 10:19:53 +01:00
pci-v5.4-changes
2019-09-23 19:16:01 -07:00
perf/headers: Fix spelling s/EACCESS/EACCES/, s/privilidge/privilege/
2019-10-28 11:02:01 +01:00
net: phy: ensure that phy IDs are correctly typed
2019-12-31 16:41:26 +01:00
driver core: platform: Add platform_get_irq_byname_optional()
2019-10-07 12:52:44 +02:00
PM / QoS: Redefine FREQ_QOS_MAX_DEFAULT_VALUE to S32_MAX
2019-12-21 11:04:31 +01:00
ptp: fix the race between the release of ptp_clock and cdev
2020-01-04 19:18:48 +01:00
lib/hexdump: make print_hex_dump_bytes() a nop on !DEBUG builds
2019-09-25 17:51:39 -07:00
pwm: Ensure pwm_apply_state() doesn't modify the state argument
2019-09-21 03:25:10 +02:00
fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
2020-01-04 19:17:25 +01:00
quota: Check that quota is not dirty before release
2019-12-17 19:56:43 +01:00
radix tree: Remove radix_tree_iter_find
2019-11-01 22:26:34 -04:00
augmented rbtree: rework the RB_DECLARE_CALLBACKS macro definition
2019-09-25 17:51:39 -07:00
tcp/dccp: fix possible race __inet_lookup_established()
2020-01-04 19:19:13 +01:00
tasks, sched/core: With a grace period after finish_task_switch(), remove unnecessary code
2019-09-25 17:42:29 +02:00
reset: fix reset_control_ops kerneldoc comment
2019-10-28 12:18:23 +01:00
reset: fix reset_control_get_exclusive kerneldoc comment
2019-10-24 10:26:33 +02:00
rseq: Unregister rseq for clone CLONE_VM
2020-02-05 21:22:43 +00:00
efi/efi_test: Lock down /dev/efi_test and require CAP_SYS_ADMIN
2019-10-31 09:40:21 +01:00
mm: shrinker: make shrinker not depend on memcg kmem
2019-09-24 15:54:11 -07:00
net: add a READ_ONCE() in skb_peek_tail()
2020-01-04 19:18:39 +01:00
bpf: Sockmap/tls, push write_space updates through ulp updates
2020-01-23 08:22:45 +01:00
mm, sl[aou]b: guarantee natural alignment for kmalloc(power-of-two)
2019-10-07 15:47:20 -07:00
net: increase SOMAXCONN to 4096
2019-10-31 14:01:40 -07:00
lib/string: Make memzero_explicit() inline instead of external
2019-10-08 13:27:05 +02:00
mm: introduce MADV_PAGEOUT
2019-09-25 17:51:41 -07:00
sysfs: Fixes __BIN_ATTR_WO() macro
2019-10-02 10:06:45 +02:00
tcp: add rcu protection around tp->fastopen_rsk
2019-10-13 10:13:08 -07:00
uaccess: disallow > INT_MAX copy sizes
2020-01-04 19:18:42 +01:00
tcp: fix rejected syncookies due to stale timestamps
2019-12-18 16:08:43 +01:00
bpf: Fix incorrect verifier simulation of ARSH under ALU32
2020-01-23 08:22:44 +01:00
efi/tpm: Only set 'efi_tpm_final_log_size' after successful event log parsing
2019-10-07 15:24:36 +02:00
uaccess: Add non-pagefault user-space write function
2020-01-17 19:48:40 +01:00
vsock/virtio: remove unused 'work' field from 'struct virtio_vsock_pkt'
2019-10-28 04:25:04 -04:00
mm/vmalloc: modify struct vmap_area to reduce its size
2019-09-24 15:54:10 -07:00
xarray.h: fix kernel-doc warning
2019-10-14 15:04:01 -07:00
zpool: add malloc_support_movable to zpool_driver
2019-09-24 15:54:12 -07:00
