Zhihao Cheng
f758987ff0
dm thin: Use last transaction's pmd->root when commit failed ...
commit 7991dbff6849f67e823b7cc0c15e5a90b0549b9f upstream.
Recently we found a softlock up problem in dm thin pool btree lookup
code due to corrupted metadata:
Kernel panic - not syncing: softlockup: hung tasks
CPU: 7 PID: 2669225 Comm: kworker/u16:3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
Workqueue: dm-thin do_worker [dm_thin_pool]
Call Trace:
<IRQ>
dump_stack+0x9c/0xd3
panic+0x35d/0x6b9
watchdog_timer_fn.cold+0x16/0x25
__run_hrtimer+0xa2/0x2d0
</IRQ>
RIP: 0010:__relink_lru+0x102/0x220 [dm_bufio]
__bufio_new+0x11f/0x4f0 [dm_bufio]
new_read+0xa3/0x1e0 [dm_bufio]
dm_bm_read_lock+0x33/0xd0 [dm_persistent_data]
ro_step+0x63/0x100 [dm_persistent_data]
btree_lookup_raw.constprop.0+0x44/0x220 [dm_persistent_data]
dm_btree_lookup+0x16f/0x210 [dm_persistent_data]
dm_thin_find_block+0x12c/0x210 [dm_thin_pool]
__process_bio_read_only+0xc5/0x400 [dm_thin_pool]
process_thin_deferred_bios+0x1a4/0x4a0 [dm_thin_pool]
process_one_work+0x3c5/0x730
Following process may generate a broken btree mixed with fresh and
stale btree nodes, which could get dm thin trapped in an infinite loop
while looking up data block:
Transaction 1: pmd->root = A, A->B->C // One path in btree
pmd->root = X, X->Y->Z // Copy-up
Transaction 2: X,Z is updated on disk, Y write failed.
// Commit failed, dm thin becomes read-only.
process_bio_read_only
dm_thin_find_block
__find_block
dm_btree_lookup(pmd->root)
The pmd->root points to a broken btree, Y may contain stale node
pointing to any block, for example X, which gets dm thin trapped into
a dead loop while looking up Z.
Fix this by setting pmd->root in __open_metadata(), so that dm thin
will use the last transaction's pmd->root if commit failed.
Fetch a reproducer in [Link].
Linke: https://bugzilla.kernel.org/show_bug.cgi?id=216790
Cc: stable@vger.kernel.org
Fixes: 991d9fa02d
2023-01-18 11:41:47 +01:00
ACPICA: Fix error code path in acpi_ds_call_control_method()
2023-01-18 11:41:34 +01:00
binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
2022-12-08 11:23:01 +01:00
ata: ahci: Fix PCS quirk application for suspend
2023-01-18 11:41:42 +01:00
atm: idt77252: fix use-after-free bugs caused by tst_timer
2022-08-25 11:18:26 +02:00
class: fix possible memory leak in __class_register()
2023-01-18 11:41:21 +01:00
drbd: use after free in drbd_create_device()
2022-11-25 17:42:16 +01:00
Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
2023-01-18 11:41:16 +01:00
bus: sunxi-rsb: Support atomic transfers
2022-12-08 11:22:57 +01:00
tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
2023-01-18 11:41:45 +01:00
clk: st: Fix memory leak in st_of_quadfs_setup()
2023-01-18 11:41:38 +01:00
clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled
2023-01-18 11:40:56 +01:00
counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update
2023-01-18 11:41:24 +01:00
cpufreq: Init completion before kobject_init_and_add()
2023-01-18 11:41:46 +01:00
cpuidle: dt: Return the correct numbers of parsed idle states
2023-01-18 11:40:53 +01:00
crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
2023-01-18 11:41:21 +01:00
drivers: dio: fix possible memory leak in dio_init()
2023-01-18 11:41:21 +01:00
dmaengine: at_hdmac: Check return code of dma_async_device_register
2022-11-25 17:42:10 +01:00
udmabuf: Set the DMA mask for the udmabuf device (v2)
2022-09-05 10:27:45 +02:00
EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
2023-01-18 11:40:55 +01:00
firmware: coreboot: Register bus in module init
2022-12-08 11:23:00 +01:00
fpga: altera-pr-ip: fix unsigned comparison with less than zero
2022-08-25 11:17:51 +02:00
fsi: core: Check error number after calling ida_simple_get
2022-10-26 13:22:41 +02:00
gpio: amd8111: Fix PCI device reference count leak
2022-12-14 11:30:44 +01:00
drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()
2023-01-18 11:41:39 +01:00
HID: plantronics: Additional PIDs for double volume key presses quirk
2023-01-18 11:41:43 +01:00
HSI: omap_ssi_core: Fix error handling in ssi_init()
2023-01-18 11:41:28 +01:00
Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
2022-12-08 11:22:58 +01:00
hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
2022-12-08 11:23:03 +01:00
intel_th: pci: Add Meteor Lake-P support
2022-08-25 11:18:13 +02:00
i2c: ismt: Fix an out-of-bounds bug in ismt_access()
2023-01-18 11:41:26 +01:00
intel_idle: Disable IBRS during long idle
2022-10-07 09:16:55 +02:00
iio: adc128s052: add proper .data members in adc128_of_match table
2023-01-18 11:41:41 +01:00
RDMA/siw: Fix pointer cast warning
2023-01-18 11:41:29 +01:00
Input: elants_i2c - properly handle the reset GPIO when power is off
2023-01-18 11:41:03 +01:00
iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()
2023-01-18 11:41:29 +01:00
irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
2023-01-18 11:40:54 +01:00
mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
2023-01-18 11:41:32 +01:00
macintosh/macio-adb: check the return value of ioremap()
2023-01-18 11:41:29 +01:00
mailbox: zynq-ipi: fix error handling while device_register() fails
2023-01-18 11:41:33 +01:00
mcb: mcb-parse: fix error handing in chameleon_parse_gdd()
2023-01-18 11:41:25 +01:00
dm thin: Use last transaction's pmd->root when commit failed
2023-01-18 11:41:47 +01:00
media: stv0288: use explicitly signed char
2023-01-18 11:41:45 +01:00
memory: of: Fix refcount leak bug in of_get_ddr_timings()
2022-10-26 13:22:31 +02:00
memstick/ms_block: Fix a memory leak
2022-08-25 11:17:55 +02:00
mfd: sm501: Add check for platform_driver_register()
2022-10-26 13:22:42 +02:00
cxl: Fix refcount leak in cxl_calc_capp_routing
2023-01-18 11:41:30 +01:00
mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K
2023-01-18 11:41:46 +01:00
mtd: maps: pxa2xx-flash: fix memory leak in probe
2023-01-18 11:41:05 +01:00
ppp: associate skb with a device at tx
2023-01-18 11:41:37 +01:00
nfc: pn533: Clear nfc_target before being used
2023-01-18 11:41:32 +01:00
NTB: ntb_tool: uninitialized heap data in tool_fn_write()
2022-08-25 11:18:26 +02:00
nvme-pci: fix doorbell buffer value endianness
2023-01-18 11:41:42 +01:00
of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()
2023-01-18 11:41:14 +01:00
opp: Fix error check in dev_pm_opp_attach_genpd()
2022-08-25 11:18:00 +02:00
parisc: Export iosapic_serial_irq() symbol for serial port driver
2022-11-10 17:57:56 +01:00
parport_pc: Avoid FIFO port location truncation
2022-11-25 17:42:14 +01:00
PCI: Check for alloc failure in pci_request_irq()
2023-01-18 11:41:18 +01:00
perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
2023-01-18 11:40:50 +01:00
phy: stm32: fix an error code in probe
2022-11-25 17:42:03 +01:00
pinctrl: pinconf-generic: add missing of_node_put()
2023-01-18 11:41:06 +01:00
platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
2023-01-18 11:40:58 +01:00
PNP: fix name memory leak in pnp_alloc_dev()
2023-01-18 11:40:54 +01:00
power: supply: fix null pointer dereferencing in power_supply_get_battery_info
2023-01-18 11:41:28 +01:00
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
2022-10-26 13:22:47 +02:00
pwm: sifive: Call pwm_sifive_update_clock() while mutex is held
2023-01-18 11:41:30 +01:00
rapidio: devices: fix missing put_device in mport_cdev_open
2023-01-18 11:40:59 +01:00
regulator: core: fix deadlock on regulator enable
2023-01-18 11:41:41 +01:00
remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region()
2023-01-18 11:41:31 +01:00
rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
2022-10-15 07:54:38 +02:00
rtc: mxc_v2: Add missing clk_disable_unprepare()
2023-01-18 11:41:32 +01:00
s390/lcs: Fix return type of lcs_start_xmit()
2023-01-18 11:41:36 +01:00
scsi: snic: Fix possible UAF in snic_tgt_create()
2023-01-18 11:41:20 +01:00
siox: fix possible memory leak in siox_device_add()
2022-11-25 17:42:14 +01:00
slimbus: stream: correct presence rate frequencies
2022-11-25 17:42:17 +01:00
ARM: ux500: do not directly dereference __iomem
2023-01-18 11:41:46 +01:00
soundwire: bus_type: fix remove and shutdown support
2022-08-25 11:17:54 +02:00
spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode
2023-01-18 11:41:12 +01:00
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
2022-10-26 13:22:43 +02:00
staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor()
2023-01-18 11:41:25 +01:00
scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()
2022-11-25 17:42:20 +01:00
tee: optee: fix possible memory leak in optee_register_device()
2022-12-08 11:22:57 +01:00
thermal: intel_powerclamp: Use first online CPU as control_cpu
2022-10-26 13:23:01 +02:00
thunderbolt: Use the actual buffer in tb_async_error()
2022-09-15 12:04:52 +02:00
serial: sunsab: Fix error handling in sunsab_init()
2023-01-18 11:41:23 +01:00
uio: uio_dmem_genirq: Fix deadlock between irq config and handling
2023-01-18 11:41:22 +01:00
usb: dwc3: core: defer probe on ulpi_read_id timeout
2023-01-18 11:41:41 +01:00
vfio: platform: Do not pass return buffer to ACPI _RST method
2023-01-18 11:41:22 +01:00
vhost/vsock: Use kvmalloc/kvfree for larger packets.
2022-10-26 13:22:25 +02:00
fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
2023-01-18 11:41:27 +01:00
vboxguest: Do not use devm for irq
2022-08-25 11:18:33 +02:00
vme: Fix error not catched in fake_init()
2023-01-18 11:41:26 +01:00
watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe()
2022-08-25 11:18:06 +02:00
xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()
2023-01-18 11:40:57 +01:00
f758987ff0