• J
    alinux: blk-throttle: fix tg NULL pointer dereference · bc0cc360
    Joseph Qi 提交于
    io throtl stats will blkg_get at the beginning of throttle and then
    blkg_put at the new introduced bi_tg_end_io. This will cause blkg to be
    freed if end_io is called twice like dm-thin, which will save origin
    end_io first, and call its overwrite end_io and then the saved end_io.
    After that, access blkg is invalid and finally BUG:
    
    [ 4417.235048] BUG: unable to handle kernel NULL pointer dereference at 00000000000001e0
    [ 4417.236475] IP: [<ffffffff812e7c71>] throtl_update_dispatch_stats+0x21/0xb0
    [ 4417.237865] PGD 98395067 PUD 362e1067 PMD 0
    [ 4417.239232] Oops: 0000 [#1] SMP
    ......
    [ 4417.274070] Call Trace:
    [ 4417.275407]  [<ffffffff812ea93d>] blk_throtl_bio+0xfd/0x630
    [ 4417.276760]  [<ffffffff810b3613>] ? wake_up_process+0x23/0x40
    [ 4417.278079]  [<ffffffff81094c04>] ? wake_up_worker+0x24/0x30
    [ 4417.279387]  [<ffffffff81095772>] ? insert_work+0x62/0xa0
    [ 4417.280697]  [<ffffffff8116c2c7>] ? mempool_free_slab+0x17/0x20
    [ 4417.282019]  [<ffffffff8116c6c9>] ? mempool_free+0x49/0x90
    [ 4417.283326]  [<ffffffff812c9acf>] generic_make_request_checks+0x16f/0x360
    [ 4417.284637]  [<ffffffffa0340d97>] ? thin_map+0x227/0x2c0 [dm_thin_pool]
    [ 4417.285951]  [<ffffffff812c9ce7>] generic_make_request+0x27/0x130
    [ 4417.287240]  [<ffffffffa0230b3d>] __map_bio+0xad/0x100 [dm_mod]
    [ 4417.288503]  [<ffffffffa023257e>] __clone_and_map_data_bio+0x15e/0x240 [dm_mod]
    [ 4417.289778]  [<ffffffffa02329ea>] __split_and_process_bio+0x38a/0x500 [dm_mod]
    [ 4417.291062]  [<ffffffffa0232c91>] dm_make_request+0x131/0x1a0 [dm_mod]
    [ 4417.292344]  [<ffffffff812c9da2>] generic_make_request+0xe2/0x130
    [ 4417.293626]  [<ffffffff812c9e61>] submit_bio+0x71/0x150
    [ 4417.294909]  [<ffffffff8121ab1d>] ? bio_alloc_bioset+0x20d/0x360
    [ 4417.296195]  [<ffffffff81215acb>] _submit_bh+0x14b/0x220
    [ 4417.297484]  [<ffffffff81215bb0>] submit_bh+0x10/0x20
    [ 4417.298744]  [<ffffffffa016d8d8>] jbd2_journal_commit_transaction+0x6c8/0x19a0 [jbd2]
    [ 4417.300014]  [<ffffffff810135b8>] ? __switch_to+0xf8/0x4c0
    [ 4417.301268]  [<ffffffffa01731e9>] kjournald2+0xc9/0x270 [jbd2]
    [ 4417.302524]  [<ffffffff810a0fd0>] ? wake_up_atomic_t+0x30/0x30
    [ 4417.303753]  [<ffffffffa0173120>] ? commit_timeout+0x10/0x10 [jbd2]
    [ 4417.304950]  [<ffffffff8109ffef>] kthread+0xcf/0xe0
    [ 4417.306107]  [<ffffffff8109ff20>] ? kthread_create_on_node+0x140/0x140
    [ 4417.307255]  [<ffffffff81647f18>] ret_from_fork+0x58/0x90
    [ 4417.308349]  [<ffffffff8109ff20>] ? kthread_create_on_node+0x140/0x140
    ......
    
    Now we introduce a new bio flag BIO_THROTL_STATED to make sure
    blkg_get/put only get called once for the same bio.
    Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>
    Reviewed-by: NJiufei Xue <jiufei.xue@linux.alibaba.com>
    Reviewed-by: NXiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
    Acked-by: NCaspar Zhang <caspar@linux.alibaba.com>
    bc0cc360
blk-throttle.c 72.1 KB