No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Theodore Ts'o c2c814fc9a memcg: fix a crash in wb_workfn when a device disappears
commit 68f23b89067fdf187763e75a56087550624fdbee upstream.

Without memcg, there is a one-to-one mapping between the bdi and
bdi_writeback structures.  In this world, things are fairly
straightforward; the first thing bdi_unregister() does is to shutdown
the bdi_writeback structure (or wb), and part of that writeback ensures
that no other work queued against the wb, and that the wb is fully
drained.

With memcg, however, there is a one-to-many relationship between the bdi
and bdi_writeback structures; that is, there are multiple wb objects
which can all point to a single bdi.  There is a refcount which prevents
the bdi object from being released (and hence, unregistered).  So in
theory, the bdi_unregister() *should* only get called once its refcount
goes to zero (bdi_put will drop the refcount, and when it is zero,
release_bdi gets called, which calls bdi_unregister).

Unfortunately, del_gendisk() in block/gen_hd.c never got the memo about
the Brave New memcg World, and calls bdi_unregister directly.  It does
this without informing the file system, or the memcg code, or anything
else.  This causes the root wb associated with the bdi to be
unregistered, but none of the memcg-specific wb's are shutdown.  So when
one of these wb's are woken up to do delayed work, they try to
dereference their wb->bdi->dev to fetch the device name, but
unfortunately bdi->dev is now NULL, thanks to the bdi_unregister()
called by del_gendisk().  As a result, *boom*.

Fortunately, it looks like the rest of the writeback path is perfectly
happy with bdi->dev and bdi->owner being NULL, so the simplest fix is to
create a bdi_dev_name() function which can handle bdi->dev being NULL.
This also allows us to bulletproof the writeback tracepoints to prevent
them from dereferencing a NULL pointer and crashing the kernel if one is
tracing with memcg's enabled, and an iSCSI device dies or a USB storage
stick is pulled.

The most common way of triggering this will be hotremoval of a device
while writeback with memcg enabled is going on.  It was triggering
several times a day in a heavily loaded production environment.

Google Bug Id: 145475544

Link: https://lore.kernel.org/r/20191227194829.150110-1-tytso@mit.edu
Link: http://lkml.kernel.org/r/20191228005211.163952-1-tytso@mit.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: Chris Mason <clm@fb.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-11 04:35:11 -08:00
arch sparc32: fix struct ipc64_perm type definition 2020-02-11 04:35:03 -08:00
block block: fix memleak of bio integrity data 2020-01-26 10:01:09 +01:00
certs PKCS#7: Refactor verify_pkcs7_signature() 2019-08-05 18:40:18 -04:00
crypto crypto: pcrypt - Fix user-after-free on module unload 2020-02-01 09:34:52 +00:00
Documentation PM / devfreq: Add new name attribute for sysfs 2020-02-05 21:22:40 +00:00
drivers usb: gadget: f_ecm: Use atomic_t to track in-flight request 2020-02-11 04:35:10 -08:00
fs memcg: fix a crash in wb_workfn when a device disappears 2020-02-11 04:35:11 -08:00
include memcg: fix a crash in wb_workfn when a device disappears 2020-02-11 04:35:11 -08:00
init Revert "um: Enable CONFIG_CONSTRUCTORS" 2020-02-01 09:34:53 +00:00
ipc ipc/msg.c: consolidate all xxxctl_down() functions 2020-02-11 04:35:07 -08:00
kernel rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special() 2020-02-11 04:35:08 -08:00
lib XArray: Fix xas_pause at ULONG_MAX 2020-02-05 21:22:47 +00:00
LICENSES LICENSES: Rename other to deprecated 2019-05-03 06:34:32 -06:00
mm memcg: fix a crash in wb_workfn when a device disappears 2020-02-11 04:35:11 -08:00
net netfilter: ipset: fix suspicious RCU usage in find_set_and_id 2020-02-11 04:35:07 -08:00
samples samples/bpf: Fix broken xdp_rxq_info due to map order assumptions 2020-01-26 10:00:58 +01:00
scripts ARM: 8950/1: ftrace/recordmcount: filter relocation types 2020-01-29 16:45:27 +01:00
security tomoyo: Use atomic_t for statistics counter 2020-02-05 21:22:41 +00:00
sound ALSA: dummy: Fix PCM format loop in proc output 2020-02-11 04:35:11 -08:00
tools objtool: Silence build output 2020-02-11 04:35:10 -08:00
usr gen_initramfs_list.sh: fix 'bad variable name' error 2020-01-09 10:20:00 +01:00
virt KVM: arm/arm64: Properly handle faulting of device mappings 2019-12-31 16:46:24 +01:00
.clang-format clang-format: Update with the latest for_each macro list 2019-08-31 10:00:51 +02:00
.cocciconfig
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes
.gitignore Modules updates for v5.4 2019-09-22 10:34:46 -07:00
.mailmap ARM: SoC fixes 2019-11-10 13:41:59 -08:00
COPYING
CREDITS MAINTAINERS: Remove Simon as Renesas SoC Co-Maintainer 2019-10-10 08:12:51 -07:00
Kbuild kbuild: do not descend to ./Kbuild when cleaning 2019-08-21 21:03:58 +09:00
Kconfig docs: kbuild: convert docs to ReST and rename to *.rst 2019-06-14 14:21:21 -06:00
MAINTAINERS MAINTAINERS: correct entries for ISDN/mISDN section 2020-02-11 04:35:06 -08:00
Makefile Linux 5.4.18 2020-02-05 21:22:53 +00:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.