mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-23 11:01:15 +00:00
c66a6f41e0
When running chunk-sized reads on disks with badblocks duplicate bio free/puts are observed: ============================================================================= BUG bio-200 (Not tainted): Object already free ----------------------------------------------------------------------------- Allocated in mempool_alloc_slab+0x17/0x20 age=3 cpu=2 pid=7504 __slab_alloc.constprop.0+0x5a/0xb0 kmem_cache_alloc+0x31e/0x330 mempool_alloc_slab+0x17/0x20 mempool_alloc+0x100/0x2b0 bio_alloc_bioset+0x181/0x460 do_mpage_readpage+0x776/0xd00 mpage_readahead+0x166/0x320 blkdev_readahead+0x15/0x20 read_pages+0x13f/0x5f0 page_cache_ra_unbounded+0x18d/0x220 force_page_cache_ra+0x181/0x1c0 page_cache_sync_ra+0x65/0xb0 filemap_get_pages+0x1df/0xaf0 filemap_read+0x1e1/0x700 blkdev_read_iter+0x1e5/0x330 vfs_read+0x42a/0x570 Freed in mempool_free_slab+0x17/0x20 age=3 cpu=2 pid=7504 kmem_cache_free+0x46d/0x490 mempool_free_slab+0x17/0x20 mempool_free+0x66/0x190 bio_free+0x78/0x90 bio_put+0x100/0x1a0 raid5_make_request+0x2259/0x2450 md_handle_request+0x402/0x600 md_submit_bio+0xd9/0x120 __submit_bio+0x11f/0x1b0 submit_bio_noacct_nocheck+0x204/0x480 submit_bio_noacct+0x32e/0xc70 submit_bio+0x98/0x1a0 mpage_readahead+0x250/0x320 blkdev_readahead+0x15/0x20 read_pages+0x13f/0x5f0 page_cache_ra_unbounded+0x18d/0x220 Slab 0xffffea000481b600 objects=21 used=0 fp=0xffff8881206d8940 flags=0x17ffffc0010201(locked|slab|head|node=0|zone=2|lastcpupid=0x1fffff) CPU: 0 PID: 34525 Comm: kworker/u24:2 Not tainted 6.0.0-rc2-localyes-265166-gf11c5343fa3f #143 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: raid5wq raid5_do_work Call Trace: <TASK> dump_stack_lvl+0x5a/0x78 dump_stack+0x10/0x16 print_trailer+0x158/0x165 object_err+0x35/0x50 free_debug_processing.cold+0xb7/0xbe __slab_free+0x1ae/0x330 kmem_cache_free+0x46d/0x490 mempool_free_slab+0x17/0x20 mempool_free+0x66/0x190 bio_free+0x78/0x90 bio_put+0x100/0x1a0 mpage_end_io+0x36/0x150 bio_endio+0x2fd/0x360 md_end_io_acct+0x7e/0x90 bio_endio+0x2fd/0x360 handle_failed_stripe+0x960/0xb80 handle_stripe+0x1348/0x3760 handle_active_stripes.constprop.0+0x72a/0xaf0 raid5_do_work+0x177/0x330 process_one_work+0x616/0xb20 worker_thread+0x2bd/0x6f0 kthread+0x179/0x1b0 ret_from_fork+0x22/0x30 </TASK> The double free is caused by an unnecessary bio_put() in the if(is_badblock(...)) error path in raid5_read_one_chunk(). The error path was moved ahead of bio_alloc_clone() in |
||
---|---|---|
.. | ||
bcache | ||
persistent-data | ||
dm-audit.c | ||
dm-audit.h | ||
dm-bio-prison-v1.c | ||
dm-bio-prison-v1.h | ||
dm-bio-prison-v2.c | ||
dm-bio-prison-v2.h | ||
dm-bio-record.h | ||
dm-bufio.c | ||
dm-builtin.c | ||
dm-cache-background-tracker.c | ||
dm-cache-background-tracker.h | ||
dm-cache-block-types.h | ||
dm-cache-metadata.c | ||
dm-cache-metadata.h | ||
dm-cache-policy-internal.h | ||
dm-cache-policy-smq.c | ||
dm-cache-policy.c | ||
dm-cache-policy.h | ||
dm-cache-target.c | ||
dm-clone-metadata.c | ||
dm-clone-metadata.h | ||
dm-clone-target.c | ||
dm-core.h | ||
dm-crypt.c | ||
dm-delay.c | ||
dm-dust.c | ||
dm-ebs-target.c | ||
dm-era-target.c | ||
dm-exception-store.c | ||
dm-exception-store.h | ||
dm-flakey.c | ||
dm-ima.c | ||
dm-ima.h | ||
dm-init.c | ||
dm-integrity.c | ||
dm-io-rewind.c | ||
dm-io-tracker.h | ||
dm-io.c | ||
dm-ioctl.c | ||
dm-kcopyd.c | ||
dm-linear.c | ||
dm-log-userspace-base.c | ||
dm-log-userspace-transfer.c | ||
dm-log-userspace-transfer.h | ||
dm-log-writes.c | ||
dm-log.c | ||
dm-mpath.c | ||
dm-mpath.h | ||
dm-path-selector.c | ||
dm-path-selector.h | ||
dm-ps-historical-service-time.c | ||
dm-ps-io-affinity.c | ||
dm-ps-queue-length.c | ||
dm-ps-round-robin.c | ||
dm-ps-service-time.c | ||
dm-raid.c | ||
dm-raid1.c | ||
dm-region-hash.c | ||
dm-rq.c | ||
dm-rq.h | ||
dm-snap-persistent.c | ||
dm-snap-transient.c | ||
dm-snap.c | ||
dm-stats.c | ||
dm-stats.h | ||
dm-stripe.c | ||
dm-switch.c | ||
dm-sysfs.c | ||
dm-table.c | ||
dm-target.c | ||
dm-thin-metadata.c | ||
dm-thin-metadata.h | ||
dm-thin.c | ||
dm-uevent.c | ||
dm-uevent.h | ||
dm-unstripe.c | ||
dm-verity-fec.c | ||
dm-verity-fec.h | ||
dm-verity-loadpin.c | ||
dm-verity-target.c | ||
dm-verity-verify-sig.c | ||
dm-verity-verify-sig.h | ||
dm-verity.h | ||
dm-writecache.c | ||
dm-zero.c | ||
dm-zone.c | ||
dm-zoned-metadata.c | ||
dm-zoned-reclaim.c | ||
dm-zoned-target.c | ||
dm-zoned.h | ||
dm.c | ||
dm.h | ||
Kconfig | ||
Makefile | ||
md-autodetect.c | ||
md-bitmap.c | ||
md-bitmap.h | ||
md-cluster.c | ||
md-cluster.h | ||
md-faulty.c | ||
md-linear.c | ||
md-linear.h | ||
md-multipath.c | ||
md-multipath.h | ||
md.c | ||
md.h | ||
raid0.c | ||
raid0.h | ||
raid1-10.c | ||
raid1.c | ||
raid1.h | ||
raid5-cache.c | ||
raid5-log.h | ||
raid5-ppl.c | ||
raid5.c | ||
raid5.h | ||
raid10.c | ||
raid10.h |