system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-10-18 17:29:25 +00:00
Code Issues Packages Projects Releases Wiki Activity
linux/drivers/md
History
Heming Zhao f7c7a2f9a2 md-cluster: fix use-after-free issue when removing rdev 
md_kick_rdev_from_array will remove rdev, so we should
use rdev_for_each_safe to search list.

How to trigger:

env: Two nodes on kvm-qemu x86_64 VMs (2C2G with 2 iscsi luns).

```
node2=192.168.0.3

for i in {1..20}; do
    echo ==== $i `date` ====;

    mdadm -Ss && ssh ${node2} "mdadm -Ss"
    wipefs -a /dev/sda /dev/sdb

    mdadm -CR /dev/md0 -b clustered -e 1.2 -n 2 -l 1 /dev/sda \
       /dev/sdb --assume-clean
    ssh ${node2} "mdadm -A /dev/md0 /dev/sda /dev/sdb"
    mdadm --wait /dev/md0
    ssh ${node2} "mdadm --wait /dev/md0"

    mdadm --manage /dev/md0 --fail /dev/sda --remove /dev/sda
    sleep 1
done
```

Crash stack:

```
stack segment: 0000 [#1] SMP
... ...
RIP: 0010:md_check_recovery+0x1e8/0x570 [md_mod]
... ...
RSP: 0018:ffffb149807a7d68 EFLAGS: 00010207
RAX: 0000000000000000 RBX: ffff9d494c180800 RCX: ffff9d490fc01e50
RDX: fffff047c0ed8308 RSI: 0000000000000246 RDI: 0000000000000246
RBP: 6b6b6b6b6b6b6b6b R08: ffff9d490fc01e40 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
R13: ffff9d494c180818 R14: ffff9d493399ef38 R15: ffff9d4933a1d800
FS:  0000000000000000(0000) GS:ffff9d494f700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe68cab9010 CR3: 000000004c6be001 CR4: 00000000003706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 raid1d+0x5c/0xd40 [raid1]
 ? finish_task_switch+0x75/0x2a0
 ? lock_timer_base+0x67/0x80
 ? try_to_del_timer_sync+0x4d/0x80
 ? del_timer_sync+0x41/0x50
 ? schedule_timeout+0x254/0x2d0
 ? md_start_sync+0xe0/0xe0 [md_mod]
 ? md_thread+0x127/0x160 [md_mod]
 md_thread+0x127/0x160 [md_mod]
 ? wait_woken+0x80/0x80
 kthread+0x10d/0x130
 ? kthread_park+0xa0/0xa0
 ret_from_fork+0x1f/0x40
```

Fixes: dbb64f8635 ("md-cluster: Fix adding of new disk with new reload code")
Fixes: 659b254fa7 ("md-cluster: remove a disk asynchronously from cluster environment")
Cc: stable@vger.kernel.org
Reviewed-by: Gang He <ghe@suse.com>
Signed-off-by: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Song Liu <song@kernel.org>
2021-04-23 09:39:04 -07:00
..
bcache bcache: fix a regression of code compiling failure in debug.c 2021-04-11 08:37:56 -06:00
persistent-data dm persistent data: fix return type of shadow_root() 2021-02-03 10:10:05 -05:00
dm-bio-prison-v1.c dm bio prison: replace spin_lock_irqsave with spin_lock_irq 2019-11-05 14:53:03 -05:00
dm-bio-prison-v1.h
dm-bio-prison-v2.c dm bio prison v2: use true/false for bool variable 2020-01-07 12:07:08 -05:00
dm-bio-prison-v2.h
dm-bio-record.h block: store a block_device pointer in struct bio 2021-01-24 18:17:20 -07:00
dm-bufio.c dm bufio: subtract the number of initial sectors in dm_bufio_get_device_size 2021-03-04 14:53:54 -05:00
dm-builtin.c
dm-cache-background-tracker.c
dm-cache-background-tracker.h
dm-cache-block-types.h
dm-cache-metadata.c dm: use bdev_read_only to check if a device is read-only 2021-01-24 18:15:57 -07:00
dm-cache-metadata.h
dm-cache-policy-internal.h
dm-cache-policy-smq.c
dm-cache-policy.c
dm-cache-policy.h
dm-cache-target.c dm cache: simplify the return expression of load_mapping() 2020-12-22 09:54:48 -05:00
dm-clone-metadata.c dm clone metadata: Fix return type of dm_clone_nr_of_hydrated_regions() 2020-03-27 14:42:51 -04:00
dm-clone-metadata.h dm clone metadata: Fix return type of dm_clone_nr_of_hydrated_regions() 2020-03-27 14:42:51 -04:00
dm-clone-target.c dm-clone: use blkdev_issue_flush in commit_metadata 2021-01-27 09:51:48 -07:00
dm-core.h dm: fix deadlock when swapping to encrypted device 2021-02-11 09:45:28 -05:00
dm-crypt.c block: rename BIO_MAX_PAGES to BIO_MAX_VECS 2021-03-11 07:47:48 -07:00
dm-delay.c block: rename generic_make_request to submit_bio_noacct 2020-07-01 07:27:24 -06:00
dm-dust.c dm dust: remove h from printk format specifier 2021-02-03 10:10:04 -05:00
dm-ebs-target.c dm ebs: avoid double unlikely() notation when using IS_ERR() 2020-12-21 13:59:37 -05:00
dm-era-target.c dm era: only resize metadata in preresume 2021-02-11 09:45:22 -05:00
dm-exception-store.c
dm-exception-store.h - Improve DM snapshot target's scalability by using finer grained 2019-05-16 15:55:48 -07:00
dm-flakey.c dm: simplify target code conditional on CONFIG_BLK_DEV_ZONED 2021-02-11 09:45:27 -05:00
dm-init.c dm init: Set file local variable static 2020-08-04 15:51:28 -04:00
dm-integrity.c dm integrity: introduce the "fix_hmac" argument 2021-02-03 10:10:05 -05:00
dm-io.c block: Add bio_max_segs 2021-02-26 15:49:51 -07:00
dm-ioctl.c dm ioctl: fix error return code in target_message 2020-12-04 18:04:36 -05:00
dm-kcopyd.c dm kcopyd: always complete failed jobs 2019-08-15 15:57:39 -04:00
dm-linear.c dm: simplify target code conditional on CONFIG_BLK_DEV_ZONED 2021-02-11 09:45:27 -05:00
dm-log-userspace-base.c
dm-log-userspace-transfer.c
dm-log-userspace-transfer.h
dm-log-writes.c block: Add bio_max_segs 2021-02-26 15:49:51 -07:00
dm-log.c
dm-mpath.c dm: use dm_table_get_device_name() where appropriate in targets 2020-09-29 16:33:08 -04:00
dm-mpath.h
dm-path-selector.c
dm-path-selector.h dm mpath: pass IO start time to path selector 2020-05-15 10:29:36 -04:00
dm-ps-historical-service-time.c dm: rename multipath path selector source files to have "dm-ps" prefix 2020-12-04 18:04:35 -05:00
dm-ps-io-affinity.c dm: rename multipath path selector source files to have "dm-ps" prefix 2020-12-04 18:04:35 -05:00
dm-ps-queue-length.c dm: rename multipath path selector source files to have "dm-ps" prefix 2020-12-04 18:04:35 -05:00
dm-ps-round-robin.c dm: rename multipath path selector source files to have "dm-ps" prefix 2020-12-04 18:04:35 -05:00
dm-ps-service-time.c dm: rename multipath path selector source files to have "dm-ps" prefix 2020-12-04 18:04:35 -05:00
dm-raid.c dm raid: fix discard limits for raid1 2021-01-04 15:02:30 -05:00
dm-raid1.c block: store a block_device pointer in struct bio 2021-01-24 18:17:20 -07:00
dm-region-hash.c
dm-rq.c block: remove the request_queue to argument request based tracepoints 2020-12-04 09:42:00 -07:00
dm-rq.h
dm-snap-persistent.c dm snap persistent: simplify area_io() 2020-09-29 16:33:12 -04:00
dm-snap-transient.c
dm-snap.c dm snapshot: flush merged data before committing metadata 2021-01-06 18:28:34 -05:00
dm-stats.c dm: replace zero-length array with flexible-array 2020-05-20 17:09:44 -04:00
dm-stats.h
dm-stripe.c dm: add support for REQ_NOWAIT to various targets 2020-12-04 18:04:35 -05:00
dm-switch.c dm: add support for REQ_NOWAIT to various targets 2020-12-04 18:04:35 -05:00
dm-sysfs.c
dm-table.c dm: support key eviction from keyslot managers of underlying devices 2021-02-11 09:45:25 -05:00
dm-target.c
dm-thin-metadata.c dm: use bdev_read_only to check if a device is read-only 2021-01-24 18:15:57 -07:00
dm-thin-metadata.h dm thin metadata: Add support for a pre-commit callback 2019-12-05 17:05:24 -05:00
dm-thin.c writeback: remove bdi->congested_fn 2020-07-08 17:20:46 -06:00
dm-uevent.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
dm-uevent.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
dm-unstripe.c dm: add support for REQ_NOWAIT to various targets 2020-12-04 18:04:35 -05:00
dm-verity-fec.c dm verity: fix FEC for RS roots unaligned to block size 2021-03-04 15:08:18 -05:00
dm-verity-fec.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
dm-verity-target.c dm verity: skip verity work if I/O error when system is shutting down 2020-12-21 13:57:25 -05:00
dm-verity-verify-sig.c dm verity: Add support for signature verification with 2nd keyring 2020-12-04 18:04:35 -05:00
dm-verity-verify-sig.h dm verity: Fix compilation warning 2020-08-04 15:48:13 -04:00
dm-verity.h dm verity: add "panic_on_corruption" error handling mode 2020-07-13 11:47:33 -04:00
dm-writecache.c block: rename BIO_MAX_PAGES to BIO_MAX_VECS 2021-03-11 07:47:48 -07:00
dm-zero.c dm: add support for REQ_NOWAIT to various targets 2020-12-04 18:04:35 -05:00
dm-zoned-metadata.c block: use an on-stack bio in blkdev_issue_flush 2021-01-27 09:51:48 -07:00
dm-zoned-reclaim.c dm zoned: Fix zone reclaim trigger 2020-07-08 12:21:53 -04:00
dm-zoned-target.c for-5.9/block-20200802 2020-08-03 11:57:03 -07:00
dm-zoned.h dm zoned: select reclaim zone based on device index 2020-06-05 14:59:53 -04:00
dm.c dm: fix deadlock when swapping to encrypted device 2021-02-11 09:45:28 -05:00
dm.h dm table: fix DAX iterate_devices based device capability checks 2021-02-09 08:45:30 -05:00
Kconfig dm crypt: support using trusted keys 2021-02-03 10:13:00 -05:00
Makefile dm: rename multipath path selector source files to have "dm-ps" prefix 2020-12-04 18:04:35 -05:00
md-autodetect.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
md-bitmap.c md/bitmap: wait for external bitmap writes to complete during tear down 2021-04-15 11:06:32 -07:00
md-bitmap.h
md-cluster.c for-5.11/drivers-2020-12-14 2020-12-16 13:09:32 -08:00
md-cluster.h
md-faulty.c block: rename generic_make_request to submit_bio_noacct 2020-07-01 07:27:24 -06:00
md-linear.c block: store a block_device pointer in struct bio 2021-01-24 18:17:20 -07:00
md-linear.h md/raid1: Replace zero-length array with flexible-array 2020-05-13 12:02:23 -07:00
md-multipath.c writeback: remove bdi->congested_fn 2020-07-08 17:20:46 -06:00
md-multipath.h
md.c md-cluster: fix use-after-free issue when removing rdev 2021-04-23 09:39:04 -07:00
md.h md: add md_submit_discard_bio() for submitting discard bio 2021-03-24 16:29:06 -07:00
raid0.c md: add md_submit_discard_bio() for submitting discard bio 2021-03-24 16:29:06 -07:00
raid0.h md/raid0: avoid RAID0 data corruption due to layout confusion. 2019-09-13 13:10:05 -07:00
raid1-10.c md: raid1-10: Unify r{1,10}bio_pool_free 2019-06-15 01:37:35 -06:00
raid1.c md: remove bio_alloc_mddev 2021-01-27 09:51:48 -07:00
raid1.h md/raid1: Replace zero-length array with flexible-array 2020-05-13 12:02:23 -07:00
raid5-cache.c block: rename BIO_MAX_PAGES to BIO_MAX_VECS 2021-03-11 07:47:48 -07:00
raid5-log.h
raid5-ppl.c block: rename BIO_MAX_PAGES to BIO_MAX_VECS 2021-03-11 07:47:48 -07:00
raid5.c for-5.12/drivers-2021-02-17 2021-02-21 11:06:54 -08:00
raid5.h md/raid5: let multiple devices of stripe_head share page 2020-09-24 16:44:44 -07:00
raid10.c md/raid10: improve discard request for far layout 2021-03-24 16:29:07 -07:00
raid10.h md/raid10: improve discard request for far layout 2021-03-24 16:29:07 -07:00