Tejun Heo cebdb6fa24 blkcg: don't call into policy draining if root_blkg is already gone ... commit 0b462c89e31f7eb6789713437eb551833ee16ff3 upstream. While a queue is being destroyed, all the blkgs are destroyed and its ->root_blkg pointer is set to NULL. If someone else starts to drain while the queue is in this state, the following oops happens. NULL pointer dereference at 0000000000000028 IP: [<ffffffff8144e944>] blk_throtl_drain+0x84/0x230 PGD e4a1067 PUD b773067 PMD 0 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC Modules linked in: cfq_iosched(-) [last unloaded: cfq_iosched] CPU: 1 PID: 537 Comm: bash Not tainted 3.16.0-rc3-work+ #2 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 task: ffff88000e222250 ti: ffff88000efd4000 task.ti: ffff88000efd4000 RIP: 0010:[<ffffffff8144e944>] [<ffffffff8144e944>] blk_throtl_drain+0x84/0x230 RSP: 0018:ffff88000efd7bf0 EFLAGS: 00010046 RAX: 0000000000000000 RBX: ffff880015091450 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88000efd7c10 R08: 0000000000000000 R09: 0000000000000001 R10: ffff88000e222250 R11: 0000000000000000 R12: ffff880015091450 R13: ffff880015092e00 R14: ffff880015091d70 R15: ffff88001508fc28 FS: 00007f1332650740(0000) GS:ffff88001fa80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000028 CR3: 0000000009446000 CR4: 00000000000006e0 Stack: ffffffff8144e8f6 ffff880015091450 0000000000000000 ffff880015091d80 ffff88000efd7c28 ffffffff8144ae2f ffff880015091450 ffff88000efd7c58 ffffffff81427641 ffff880015091450 ffffffff82401f00 ffff880015091450 Call Trace: [<ffffffff8144ae2f>] blkcg_drain_queue+0x1f/0x60 [<ffffffff81427641>] __blk_drain_queue+0x71/0x180 [<ffffffff81429b3e>] blk_queue_bypass_start+0x6e/0xb0 [<ffffffff814498b8>] blkcg_deactivate_policy+0x38/0x120 [<ffffffff8144ec44>] blk_throtl_exit+0x34/0x50 [<ffffffff8144aea5>] blkcg_exit_queue+0x35/0x40 [<ffffffff8142d476>] blk_release_queue+0x26/0xd0 [<ffffffff81454968>] kobject_cleanup+0x38/0x70 [<ffffffff81454848>] kobject_put+0x28/0x60 [<ffffffff81427505>] blk_put_queue+0x15/0x20 [<ffffffff817d07bb>] scsi_device_dev_release_usercontext+0x16b/0x1c0 [<ffffffff810bc339>] execute_in_process_context+0x89/0xa0 [<ffffffff817d064c>] scsi_device_dev_release+0x1c/0x20 [<ffffffff817930e2>] device_release+0x32/0xa0 [<ffffffff81454968>] kobject_cleanup+0x38/0x70 [<ffffffff81454848>] kobject_put+0x28/0x60 [<ffffffff817934d7>] put_device+0x17/0x20 [<ffffffff817d11b9>] __scsi_remove_device+0xa9/0xe0 [<ffffffff817d121b>] scsi_remove_device+0x2b/0x40 [<ffffffff817d1257>] sdev_store_delete+0x27/0x30 [<ffffffff81792ca8>] dev_attr_store+0x18/0x30 [<ffffffff8126f75e>] sysfs_kf_write+0x3e/0x50 [<ffffffff8126ea87>] kernfs_fop_write+0xe7/0x170 [<ffffffff811f5e9f>] vfs_write+0xaf/0x1d0 [<ffffffff811f69bd>] SyS_write+0x4d/0xc0 [<ffffffff81d24692>] system_call_fastpath+0x16/0x1b 776687bce42b ("block, blk-mq: draining can't be skipped even if bypass_depth was non-zero") made it easier to trigger this bug by making blk_queue_bypass_start() drain even when it loses the first bypass test to blk_cleanup_queue(); however, the bug has always been there even before the commit as blk_queue_bypass_start() could race against queue destruction, win the initial bypass test but perform the actual draining after blk_cleanup_queue() already destroyed all blkgs. Fix it by skippping calling into policy draining if all the blkgs are already gone. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Shirish Pargaonkar <spargaonkar@suse.com> Reported-by: Sasha Levin <sasha.levin@oracle.com> Reported-by: Jet Chen <jet.chen@intel.com> Tested-by: Shirish Pargaonkar <spargaonkar@suse.com> Signed-off-by: Jens Axboe <axboe@fb.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-07-31 12:53:49 -07:00
..
partitions	partitions/efi.c: replace useless kzalloc's by kmalloc's	2013-04-30 08:34:25 +02:00
blk-cgroup.c	blkcg: don't call into policy draining if root_blkg is already gone	2014-07-31 12:53:49 -07:00
blk-cgroup.h	Update of blkg_stat and blkg_rwstat may happen in bh context. While u64_stats_fetch_retry is only preempt_disable on 32bit UP system. This is not enough to avoid preemption by bh and may read strange 64 bit value.	2013-12-11 22:36:27 -08:00
blk-core.c	blktrace: fix accounting of partially completed requests	2014-05-30 21:52:11 -07:00
blk-exec.c	Merge branch 'for-3.9/core' of git://git.kernel.dk/linux-block	2013-02-28 12:52:24 -08:00
blk-flush.c	Block: blk-flush: Fixed indent code style	2013-03-22 12:22:51 -06:00
blk-integrity.c	scatterlist: introduce sg_unmark_end	2013-03-20 15:43:04 +10:30
blk-ioc.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
blk-iopoll.c
blk-lib.c	block: add cond_resched() to potentially long running ioctl discard loop	2014-02-22 12:41:28 -08:00
blk-map.c
blk-merge.c	scatterlist: introduce sg_unmark_end	2013-03-20 15:43:04 +10:30
blk-settings.c	block: properly stack underlying max_segment_size to DM device	2013-11-29 11:11:51 -08:00
blk-softirq.c
blk-sysfs.c	block: avoid using uninitialized value in from queue_var_store	2013-04-03 21:53:57 +02:00
blk-tag.c	block: don't assume last put of shared tags is for the host	2014-07-31 12:53:48 -07:00
blk-throttle.c	block: Rename queue dead flag	2012-12-06 14:30:58 +01:00
blk-timeout.c	block: fix race between request completion and timeout handling	2013-11-29 11:11:50 -08:00
blk.h	block: __elv_next_request() shouldn't call into the elevator if bypassing	2014-02-22 12:41:28 -08:00
bsg-lib.c	bsg: Remove unused function bsg_goose_queue()	2012-12-06 14:33:02 +01:00
bsg.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
cfq-iosched.c	cfq: explicitly use 64bit divide operation for 64bit arguments	2013-10-01 09:17:48 -07:00
compat_ioctl.c	block: provide compat ioctl for BLKZEROOUT	2014-07-31 12:53:48 -07:00
deadline-iosched.c	elevator: Fix a race in elevator switching	2013-08-20 08:43:03 -07:00
elevator.c	elevator: acquire q->sysfs_lock in elevator_change()	2013-12-08 07:29:27 -08:00
genhd.c	block: do not pass disk names as format strings	2013-07-13 11:42:26 -07:00
ioctl.c
Kconfig	block: don't select PERCPU_RWSEM	2013-02-22 10:42:45 +01:00
Kconfig.iosched
Makefile
noop-iosched.c	elevator: Fix a race in elevator switching	2013-08-20 08:43:03 -07:00
partition-generic.c	Revert "loop: cleanup partitions when detaching loop device"	2013-04-08 10:12:11 +02:00
scsi_ioctl.c	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00