Filipe Manana ce7791ffee Btrfs: fix race between readahead and device replace/removal ... The list of devices is protected by the device_list_mutex and the device replace code, in its finishing phase correctly takes that mutex before removing the source device from that list. However the readahead code was iterating that list without acquiring the respective mutex leading to crashes later on due to invalid memory accesses: [125671.831036] general protection fault: 0000 [#1] PREEMPT SMP [125671.832129] Modules linked in: btrfs dm_flakey dm_mod crc32c_generic xor raid6_pq acpi_cpufreq tpm_tis tpm ppdev evdev parport_pc psmouse sg parport processor ser [125671.834973] CPU: 10 PID: 19603 Comm: kworker/u32:19 Tainted: G W 4.6.0-rc7-btrfs-next-29+ #1 [125671.834973] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS by qemu-project.org 04/01/2014 [125671.834973] Workqueue: btrfs-readahead btrfs_readahead_helper [btrfs] [125671.834973] task: ffff8801ac520540 ti: ffff8801ac918000 task.ti: ffff8801ac918000 [125671.834973] RIP: 0010:[<ffffffff81270479>] [<ffffffff81270479>] __radix_tree_lookup+0x6a/0x105 [125671.834973] RSP: 0018:ffff8801ac91bc28 EFLAGS: 00010206 [125671.834973] RAX: 0000000000000000 RBX: 6b6b6b6b6b6b6b6a RCX: 0000000000000000 [125671.834973] RDX: 0000000000000000 RSI: 00000000000c1bff RDI: ffff88002ebd62a8 [125671.834973] RBP: ffff8801ac91bc70 R08: 0000000000000001 R09: 0000000000000000 [125671.834973] R10: ffff8801ac91bc70 R11: 0000000000000000 R12: ffff88002ebd62a8 [125671.834973] R13: 0000000000000000 R14: 0000000000000000 R15: 00000000000c1bff [125671.834973] FS: 0000000000000000(0000) GS:ffff88023fd40000(0000) knlGS:0000000000000000 [125671.834973] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [125671.834973] CR2: 000000000073cae4 CR3: 00000000b7723000 CR4: 00000000000006e0 [125671.834973] Stack: [125671.834973] 0000000000000000 ffff8801422d5600 ffff8802286bbc00 0000000000000000 [125671.834973] 0000000000000001 ffff8802286bbc00 00000000000c1bff 0000000000000000 [125671.834973] ffff88002e639eb8 ffff8801ac91bc80 ffffffff81270541 ffff8801ac91bcb0 [125671.834973] Call Trace: [125671.834973] [<ffffffff81270541>] radix_tree_lookup+0xd/0xf [125671.834973] [<ffffffffa04ae6a6>] reada_peer_zones_set_lock+0x3e/0x60 [btrfs] [125671.834973] [<ffffffffa04ae8b9>] reada_pick_zone+0x29/0x103 [btrfs] [125671.834973] [<ffffffffa04af42f>] reada_start_machine_worker+0x129/0x2d3 [btrfs] [125671.834973] [<ffffffffa04880be>] btrfs_scrubparity_helper+0x185/0x3aa [btrfs] [125671.834973] [<ffffffffa0488341>] btrfs_readahead_helper+0xe/0x10 [btrfs] [125671.834973] [<ffffffff81069691>] process_one_work+0x271/0x4e9 [125671.834973] [<ffffffff81069dda>] worker_thread+0x1eb/0x2c9 [125671.834973] [<ffffffff81069bef>] ? rescuer_thread+0x2b3/0x2b3 [125671.834973] [<ffffffff8106f403>] kthread+0xd4/0xdc [125671.834973] [<ffffffff8149e242>] ret_from_fork+0x22/0x40 [125671.834973] [<ffffffff8106f32f>] ? kthread_stop+0x286/0x286 So fix this by taking the device_list_mutex in the readahead code. We can't use here the lighter approach of using a rcu_read_lock() and rcu_read_unlock() pair together with a list_for_each_entry_rcu() call because we end up doing calls to sleeping functions (kzalloc()) in the respective code path. Signed-off-by: Filipe Manana <fdmanana@suse.com> Reviewed-by: Josef Bacik <jbacik@fb.com>		2016-05-30 12:58:18 +01:00
..
tests	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
acl.c	Merge branch 'for-linus-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2016-01-18 12:44:40 -08:00
async-thread.c	btrfs: async-thread: Fix a use-after-free error for trace	2016-01-25 16:50:26 -08:00
async-thread.h
backref.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
backref.h
btrfs_inode.h	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
check-integrity.c	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
check-integrity.h
compression.c	btrfs: make find_workspace warn if there are no workspaces	2016-05-10 09:46:16 +02:00
compression.h	btrfs: move btrfs_compression_type to compression.h	2016-03-11 17:12:46 +01:00
ctree.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
ctree.h	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
delayed-inode.c	btrfs: GFP_NOFS does not GFP_HIGHMEM	2016-05-10 09:44:21 +02:00
delayed-inode.h	btrfs: properly set the termination value of ctx->pos in readdir	2016-02-11 07:01:59 -08:00
delayed-ref.c	btrfs: drop null testing before destroy functions	2016-02-18 11:46:03 +01:00
delayed-ref.h	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
dev-replace.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
dev-replace.h	btrfs: refactor btrfs_dev_replace_start for reuse	2016-04-28 10:59:13 +02:00
dir-item.c
disk-io.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
disk-io.h	Merge branch 'misc-cleanups-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into for-linus-4.5	2016-01-11 06:08:37 -08:00
export.c
export.h
extent-tree.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
extent_io.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
extent_io.h	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
extent_map.c	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
extent_map.h	btrfs: cleanup, stop casting for extent_map->lookup everywhere	2016-01-15 19:22:28 +01:00
file-item.c	btrfs: sink gfp parameter to set_extent_bits	2016-04-29 11:01:47 +02:00
file.c	Btrfs: fix handling of faults from btrfs_copy_from_user	2016-05-26 13:23:59 -07:00
free-space-cache.c	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
free-space-cache.h	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
free-space-tree.c	Revert "btrfs: synchronize incompat feature bits with sysfs files"	2016-01-29 08:19:37 -08:00
free-space-tree.h	Btrfs: implement the free space B-tree	2015-12-17 12:16:47 -08:00
hash.c
hash.h
inode-item.c	btrfs: rename btrfs_std_error to btrfs_handle_fs_error	2016-04-28 10:36:54 +02:00
inode-map.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
inode-map.h	Btrfs: Initialize btrfs_root->highest_objectid when loading tree root and subvolume roots	2016-01-15 19:25:02 +01:00
inode.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
ioctl.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
Kconfig
locking.c	btrfs: cleanup, remove stray return statements	2016-01-07 14:30:52 +01:00
locking.h
lzo.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
Makefile	Btrfs: add free space tree sanity tests	2015-12-17 12:16:47 -08:00
math.h
ordered-data.c	Btrfs: don't wait for unrelated IO to finish before relocation	2016-05-13 01:59:14 +01:00
ordered-data.h	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
orphan.c
print-tree.c	btrfs: teach print_leaf about temporary item subtypes	2016-02-11 16:15:43 +01:00
print-tree.h
props.c	btrfs: move btrfs_compression_type to compression.h	2016-03-11 17:12:46 +01:00
props.h
qgroup.c	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
qgroup.h	btrfs: qgroup: Check if qgroup reserved space leaked	2015-10-21 18:41:10 -07:00
raid56.c	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
raid56.h
rcu-string.h
reada.c	Btrfs: fix race between readahead and device replace/removal	2016-05-30 12:58:18 +01:00
relocation.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
root-tree.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
scrub.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
send.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
send.h	Btrfs: use linux/sizes.h to represent constants	2016-01-07 14:38:02 +01:00
struct-funcs.c	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
super.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
sysfs.c	btrfs: sysfs: protect reading label by lock	2016-05-06 15:22:49 +02:00
sysfs.h	btrfs: sysfs: introduce helper for syncing bits with sysfs files	2016-01-21 18:50:40 +01:00
transaction.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
transaction.h	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
tree-defrag.c	Btrfs: fix locking bugs when defragging leaves	2015-12-18 02:51:32 +00:00
tree-log.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
tree-log.h	Btrfs: fix unreplayable log after snapshot delete + parent dir fsync	2016-03-01 08:23:25 -08:00
ulist.c	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
ulist.h
uuid-tree.c
volumes.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
volumes.h	Merge branch 'foreign/jeffm/uapi' into for-chris-4.7-20160516	2016-05-16 15:46:29 +02:00
xattr.c	Btrfs: fix listxattrs not listing all xattrs packed in the same item	2016-03-01 08:23:41 -08:00
xattr.h	btrfs: Use xattr handler infrastructure	2015-12-06 21:34:14 -05:00
zlib.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00