Filipe Manana ce7791ffee Btrfs: fix race between readahead and device replace/removal ... The list of devices is protected by the device_list_mutex and the device replace code, in its finishing phase correctly takes that mutex before removing the source device from that list. However the readahead code was iterating that list without acquiring the respective mutex leading to crashes later on due to invalid memory accesses: [125671.831036] general protection fault: 0000 [#1] PREEMPT SMP [125671.832129] Modules linked in: btrfs dm_flakey dm_mod crc32c_generic xor raid6_pq acpi_cpufreq tpm_tis tpm ppdev evdev parport_pc psmouse sg parport processor ser [125671.834973] CPU: 10 PID: 19603 Comm: kworker/u32:19 Tainted: G W 4.6.0-rc7-btrfs-next-29+ #1 [125671.834973] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS by qemu-project.org 04/01/2014 [125671.834973] Workqueue: btrfs-readahead btrfs_readahead_helper [btrfs] [125671.834973] task: ffff8801ac520540 ti: ffff8801ac918000 task.ti: ffff8801ac918000 [125671.834973] RIP: 0010:[<ffffffff81270479>] [<ffffffff81270479>] __radix_tree_lookup+0x6a/0x105 [125671.834973] RSP: 0018:ffff8801ac91bc28 EFLAGS: 00010206 [125671.834973] RAX: 0000000000000000 RBX: 6b6b6b6b6b6b6b6a RCX: 0000000000000000 [125671.834973] RDX: 0000000000000000 RSI: 00000000000c1bff RDI: ffff88002ebd62a8 [125671.834973] RBP: ffff8801ac91bc70 R08: 0000000000000001 R09: 0000000000000000 [125671.834973] R10: ffff8801ac91bc70 R11: 0000000000000000 R12: ffff88002ebd62a8 [125671.834973] R13: 0000000000000000 R14: 0000000000000000 R15: 00000000000c1bff [125671.834973] FS: 0000000000000000(0000) GS:ffff88023fd40000(0000) knlGS:0000000000000000 [125671.834973] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [125671.834973] CR2: 000000000073cae4 CR3: 00000000b7723000 CR4: 00000000000006e0 [125671.834973] Stack: [125671.834973] 0000000000000000 ffff8801422d5600 ffff8802286bbc00 0000000000000000 [125671.834973] 0000000000000001 ffff8802286bbc00 00000000000c1bff 0000000000000000 [125671.834973] ffff88002e639eb8 ffff8801ac91bc80 ffffffff81270541 ffff8801ac91bcb0 [125671.834973] Call Trace: [125671.834973] [<ffffffff81270541>] radix_tree_lookup+0xd/0xf [125671.834973] [<ffffffffa04ae6a6>] reada_peer_zones_set_lock+0x3e/0x60 [btrfs] [125671.834973] [<ffffffffa04ae8b9>] reada_pick_zone+0x29/0x103 [btrfs] [125671.834973] [<ffffffffa04af42f>] reada_start_machine_worker+0x129/0x2d3 [btrfs] [125671.834973] [<ffffffffa04880be>] btrfs_scrubparity_helper+0x185/0x3aa [btrfs] [125671.834973] [<ffffffffa0488341>] btrfs_readahead_helper+0xe/0x10 [btrfs] [125671.834973] [<ffffffff81069691>] process_one_work+0x271/0x4e9 [125671.834973] [<ffffffff81069dda>] worker_thread+0x1eb/0x2c9 [125671.834973] [<ffffffff81069bef>] ? rescuer_thread+0x2b3/0x2b3 [125671.834973] [<ffffffff8106f403>] kthread+0xd4/0xdc [125671.834973] [<ffffffff8149e242>] ret_from_fork+0x22/0x40 [125671.834973] [<ffffffff8106f32f>] ? kthread_stop+0x286/0x286 So fix this by taking the device_list_mutex in the readahead code. We can't use here the lighter approach of using a rcu_read_lock() and rcu_read_unlock() pair together with a list_for_each_entry_rcu() call because we end up doing calls to sleeping functions (kzalloc()) in the respective code path. Signed-off-by: Filipe Manana <fdmanana@suse.com> Reviewed-by: Josef Bacik <jbacik@fb.com>		2016-05-30 12:58:18 +01:00
..
9p	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
adfs	fs/adfs/adfs.h: tidy up comments	2016-01-20 17:09:18 -08:00
affs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
afs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
autofs4	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2016-03-19 18:52:29 -07:00
befs
bfs
btrfs	Btrfs: fix race between readahead and device replace/removal	2016-05-30 12:58:18 +01:00
cachefiles	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
ceph	libceph: make authorizer destruction independent of ceph_auth_client	2016-04-25 20:54:13 +02:00
cifs	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
coda	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2016-01-23 12:24:56 -08:00
configfs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
cramfs	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
crypto	ext4/fscrypto: avoid RCU lookup in d_revalidate	2016-04-12 20:01:35 -07:00
debugfs	debugfs: Make automount point inodes permanently empty	2016-04-12 15:01:53 -07:00
devpts	devpts: more pty driver interface cleanups	2016-04-26 15:47:32 -07:00
dlm	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
ecryptfs	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
efivarfs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
efs
exofs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
exportfs	wrappers for ->i_mutex access	2016-01-22 18:04:28 -05:00
ext2	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
ext4	ext4/fscrypto: avoid RCU lookup in d_revalidate	2016-04-12 20:01:35 -07:00
f2fs	fscrypto: don't let data integrity writebacks fail with ENOMEM	2016-04-12 10:25:30 -07:00
fat	fat: add config option to set UTF-8 mount option by default	2016-03-22 15:36:02 -07:00
freevxfs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
fscache	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
fuse	fuse: Fix return value from fuse_get_user_pages()	2016-04-25 13:01:04 +02:00
gfs2	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
hfs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
hfsplus	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
hostfs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
hpfs	hpfs: don't truncate the file when delete fails	2016-02-27 19:15:51 -05:00
hugetlbfs	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
isofs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
jbd2	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
jffs2	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
jfs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
kernfs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
lockd
logfs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
minix	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
ncpfs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
nfs	These changes contains a fix for overlayfs interacting with some	2016-04-07 17:22:20 -07:00
nfs_common
nfsd	Various bugfixes, a RDMA update from Chuck Lever, and support for a new	2016-03-24 19:50:32 -07:00
nilfs2	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
nls
notify	fsnotify: turn fsnotify reaper thread into a workqueue job	2016-02-18 16:23:24 -08:00
ntfs	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
ocfs2	ocfs2/dlm: return zero if deref_done message is successfully handled	2016-04-28 19:34:04 -07:00
omfs
openpromfs
orangefs	Orangefs: cleanups and a strncpy vulnerability fix.	2016-04-09 10:33:58 -07:00
overlayfs	fs: add file_dentry()	2016-03-26 16:14:37 -04:00
proc	proc: prevent accessing /proc/<PID>/environ until it's ready	2016-05-05 17:38:53 -07:00
pstore	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
qnx4
qnx6	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
quota	quota: Handle Q_GETNEXTQUOTA when quota is disabled	2016-03-29 17:20:10 +02:00
ramfs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
reiserfs	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
romfs
squashfs	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
sysfs
sysv	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
tracefs	wrappers for ->i_mutex access	2016-01-22 18:04:28 -05:00
ubifs	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
udf	udf: Fix conversion of 'dstring' fields to UTF8	2016-04-25 15:18:50 +02:00
ufs	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
xfs	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
aio.c
anon_inodes.c
attr.c	wrappers for ->i_mutex access	2016-01-22 18:04:28 -05:00
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
binfmt_elf.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c	wrappers for ->i_mutex access	2016-01-22 18:04:28 -05:00
binfmt_script.c
block_dev.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
buffer.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
char_dev.c
compat_binfmt_elf.c
compat_ioctl.c	Merge 4.5-rc4 into char-misc-next	2016-02-14 14:25:59 -08:00
compat.c
coredump.c	fs/coredump: prevent fsuid=0 dumps into user-controlled directories	2016-03-22 15:36:02 -07:00
dax.c	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
dcache.c	fs: add file_dentry()	2016-03-26 16:14:37 -04:00
dcookies.c
direct-io.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
drop_caches.c
eventfd.c	eventfd: document lockless access in eventfd_poll	2016-03-22 15:36:02 -07:00
eventpoll.c	timer: convert timer_slack_ns from unsigned long to u64	2016-03-17 15:09:34 -07:00
exec.c	Merge branch 'mm-pkeys-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2016-03-20 19:08:56 -07:00
fcntl.c
fhandle.c	fs/coredump: prevent fsuid=0 dumps into user-controlled directories	2016-03-22 15:36:02 -07:00
file_table.c
file.c
filesystems.c
fs_pin.c
fs_struct.c
fs-writeback.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
inode.c	writeback: initialize inode members that track writeback history	2016-02-16 14:57:21 -07:00
internal.h
ioctl.c	wrappers for ->i_mutex access	2016-01-22 18:04:28 -05:00
Kconfig	Merge tag 'ofs-pull-tag-1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux	2016-03-26 12:59:04 -07:00
Kconfig.binfmt
libfs.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
locks.c	wrappers for ->i_mutex access	2016-01-22 18:04:28 -05:00
Makefile	Merge tag 'ofs-pull-tag-1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux	2016-03-26 12:59:04 -07:00
mbcache.c	mbcache: add reusable flag to cache entries	2016-02-22 22:44:04 -05:00
mount.h
mpage.c	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
namei.c	fix the braino in "namei: massage lookup_slow() to be usable by lookup_one_len_unlocked()"	2016-03-31 00:23:05 -04:00
namespace.c	wrappers for ->i_mutex access	2016-01-22 18:04:28 -05:00
no-block.c
nsfs.c
open.c	fs/coredump: prevent fsuid=0 dumps into user-controlled directories	2016-03-22 15:36:02 -07:00
pipe.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
pnode.c	propogate_mnt: Handle the first propogated copy being a slave	2016-05-05 09:54:45 -05:00
pnode.h
posix_acl.c
proc_namespace.c	vfs: show_vfsstat: do not ignore errors from show_devname method	2016-03-16 13:09:08 -04:00
read_write.c	Merge branches 'work.lookups', 'work.misc' and 'work.preadv2' into for-next	2016-03-18 16:07:38 -04:00
readdir.c	wrappers for ->i_mutex access	2016-01-22 18:04:28 -05:00
select.c	timer: convert timer_slack_ns from unsigned long to u64	2016-03-17 15:09:34 -07:00
seq_file.c	Make file credentials available to the seqfile interfaces	2016-04-14 12:56:09 -07:00
signalfd.c
splice.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
stack.c
stat.c
statfs.c
super.c	writeback: flush inode cgroup wb switches instead of pinning super_block	2016-03-03 14:42:50 -07:00
sync.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
timerfd.c
userfaultfd.c	userfaultfd: don't block on the last VM updates at exit time	2016-03-02 09:03:18 -08:00
utimes.c	wrappers for ->i_mutex access	2016-01-22 18:04:28 -05:00
xattr.c	xattr handlers: plug a lock leak in simple_xattr_list	2016-02-20 00:15:51 -05:00