From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Takashi Iwai <tiwai@suse.de>,
David Disseldorp <ddiss@suse.de>,
Minchan Kim <minchan@kernel.org>,
Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 4.4 02/13] zram: fix unbalanced idr management at hot removal
Date: Wed, 7 Dec 2016 08:07:41 +0100 [thread overview]
Message-ID: <20161207070716.423057287@linuxfoundation.org> (raw)
In-Reply-To: <20161207070716.317145973@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 529e71e16403830ae0d737a66c55c5f360f3576b upstream.
The zram hot removal code calls idr_remove() even when zram_remove()
returns an error (typically -EBUSY). This results in a leftover at the
device release, eventually leading to a crash when the module is
reloaded.
As described in the bug report below, the following procedure would
cause an Oops with zram:
- provision three zram devices via modprobe zram num_devices=3
- configure a size for each device
+ echo "1G" > /sys/block/$zram_name/disksize
- mkfs and mount zram0 only
- attempt to hot remove all three devices
+ echo 2 > /sys/class/zram-control/hot_remove
+ echo 1 > /sys/class/zram-control/hot_remove
+ echo 0 > /sys/class/zram-control/hot_remove
- zram0 removal fails with EBUSY, as expected
- unmount zram0
- try zram0 hot remove again
+ echo 0 > /sys/class/zram-control/hot_remove
- fails with ENODEV (unexpected)
- unload zram kernel module
+ completes successfully
- zram0 device node still exists
- attempt to mount /dev/zram0
+ mount command is killed
+ following BUG is encountered
BUG: unable to handle kernel paging request at ffffffffa0002ba0
IP: get_disk+0x16/0x50
Oops: 0000 [#1] SMP
CPU: 0 PID: 252 Comm: mount Not tainted 4.9.0-rc6 #176
Call Trace:
exact_lock+0xc/0x20
kobj_lookup+0xdc/0x160
get_gendisk+0x2f/0x110
__blkdev_get+0x10c/0x3c0
blkdev_get+0x19d/0x2e0
blkdev_open+0x56/0x70
do_dentry_open.isra.19+0x1ff/0x310
vfs_open+0x43/0x60
path_openat+0x2c9/0xf30
do_filp_open+0x79/0xd0
do_sys_open+0x114/0x1e0
SyS_open+0x19/0x20
entry_SYSCALL_64_fastpath+0x13/0x94
This patch adds the proper error check in hot_remove_store() not to call
idr_remove() unconditionally.
Fixes: 17ec4cd98578 ("zram: don't call idr_remove() from zram_remove()")
Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1010970
Link: http://lkml.kernel.org/r/20161121132140.12683-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: David Disseldorp <ddiss@suse.de>
Reported-by: David Disseldorp <ddiss@suse.de>
Tested-by: David Disseldorp <ddiss@suse.de>
Acked-by: Minchan Kim <minchan@kernel.org>
Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/zram/zram_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1368,7 +1368,8 @@ static ssize_t hot_remove_store(struct c
zram = idr_find(&zram_index_idr, dev_id);
if (zram) {
ret = zram_remove(zram);
- idr_remove(&zram_index_idr, dev_id);
+ if (!ret)
+ idr_remove(&zram_index_idr, dev_id);
} else {
ret = -ENODEV;
}
next prev parent reply other threads:[~2016-12-07 7:08 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20161207070805epcas3p1487b13063215635759cae58441ad906a@epcas3p1.samsung.com>
2016-12-07 7:07 ` [PATCH 4.4 00/13] 4.4.37-stable review Greg Kroah-Hartman
2016-12-07 7:07 ` [PATCH 4.4 01/13] ARC: Dont use "+l" inline asm constraint Greg Kroah-Hartman
2016-12-07 7:07 ` Greg Kroah-Hartman [this message]
2016-12-07 7:07 ` [PATCH 4.4 03/13] kasan: update kasan_global for gcc 7 Greg Kroah-Hartman
2016-12-07 7:07 ` [PATCH 4.4 04/13] x86/traps: Ignore high word of regs->cs in early_fixup_exception() Greg Kroah-Hartman
2016-12-07 7:07 ` [PATCH 4.4 05/13] ALSA: pcm : Call kill_fasync() in stream lock Greg Kroah-Hartman
2016-12-07 7:07 ` [PATCH 4.4 06/13] rcu: Fix soft lockup for rcu_nocb_kthread Greg Kroah-Hartman
2016-12-07 7:07 ` [PATCH 4.4 07/13] PCI: Export pcie_find_root_port Greg Kroah-Hartman
2016-12-07 7:07 ` [PATCH 4.4 09/13] mwifiex: printk() overflow with 32-byte SSIDs Greg Kroah-Hartman
2016-12-07 7:07 ` [PATCH 4.4 10/13] pwm: Fix device reference leak Greg Kroah-Hartman
2016-12-07 7:07 ` [PATCH 4.4 11/13] arm64: cpufeature: Schedule enable() calls instead of calling them via IPI Greg Kroah-Hartman
2016-12-07 7:07 ` [PATCH 4.4 12/13] arm64: mm: Set PSTATE.PAN from the cpu_enable_pan() call Greg Kroah-Hartman
2016-12-07 7:07 ` [PATCH 4.4 13/13] arm64: suspend: Reconfigure PSTATE after resume from idle Greg Kroah-Hartman
2016-12-07 16:07 ` [PATCH 4.4 00/13] 4.4.37-stable review Guenter Roeck
2016-12-07 18:17 ` Shuah Khan
[not found] ` <5847f96a.45f6c20a.fab5.7b38@mx.google.com>
[not found] ` <m2inqvekqu.fsf@baylibre.com>
2016-12-08 16:25 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161207070716.423057287@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=ddiss@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=minchan@kernel.org \
--cc=sergey.senozhatsky@gmail.com \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).