Re: 4.20-rc1 looks broken for UML

[Anton Ivanov <anton.ivanov@kot-begemot.co.uk>]

On 11/7/18 10:46 AM, Anton Ivanov wrote:
> On 11/7/18 7:53 AM, Christoph Hellwig wrote:
>
>> On Tue, Nov 06, 2018 at 09:49:45PM +0100, Richard Weinberger wrote:
>>> Christoph,
>>>
>>> Anton found a problem in your "ubd: remove use of blk_rq_map_sg" patch.
>>> With CONFIG_DEBUG_PAGEALLOC enabled, the ubd driver crashes because 
>>> it tries
>>> to deref address 0x12345678, which is the poison from 
>>> store_stackinfo().
>>>
>>> Please see below for more info.
>>> Can it be that your change introduced a use-after-free bug in UML's 
>>> block driver?
>> Sounds like it.  But I'll need some more time to debug it.
>
> I had to revert 4e6da0fe8058df9bfa937902fcd9cb2b7b89b2df "um: Convert 
> ubd driver to blk-mq" as well to get things back to business as usual.

First of all, I apologize for not looking at it properly when it first 
came out, I was buried under openswitch and opendaylight at the time.

I have looked at it again and I see a few issues with it:

1. On transient failure after a requeue it returns BLK_STS_OK, shouldn't 
this be BLK_STS_RESOURCE?

2. On transient failure it redoes the whole SG list. That should not be 
the case, it should record how far it got to and redo the list from there:

https://elixir.bootlin.com/linux/latest/source/drivers/block/nbd.c#L509

These should not prevent it from working though and should not cause an 
immediate failure when trying to mount rw or remount a ro as rw. I have 
not found the cause for that one yet.

A.


>
> The block-mq driver works for reading - no issues if everything is ro. 
> It also clearly works for writing for some configs in older kernels, 
> otherwise it would have been picked up.
>
> Something changed in 4.20-rc1 which made it fail in my config. The 
> failure is instantaneous for 4.20-rc1 with only 
> ecb0a83e3198f2c1142901687afacbc73602a13b " ubd: remove use of 
> blk_rq_map_sg" reverted.
>
> Reverting both and restoring the driver to 4.19 state fixes things.
>
> I am going to give it a go to debug exactly what breaks for writing in 
> ecb0a83e3198f2c1142901687afacbc73602a13b " ubd: remove use of 
> blk_rq_map_sg".
>
> A.
>
>
>>
>> _______________________________________________
>> linux-um mailing list
>> linux-um@lists.infradead.org
>> http://lists.infradead.org/mailman/listinfo/linux-um
>>

_______________________________________________
linux-um mailing list
linux-um@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-um