linux-stable/drivers/md/bcache
Mingzhe Zou f0854489fc bcache: fixup btree_cache_wait list damage
We get a kernel crash about "list_add corruption. next->prev should be
prev (ffff9c801bc01210), but was ffff9c77b688237c.
(next=ffffae586d8afe68)."

crash> struct list_head 0xffff9c801bc01210
struct list_head {
  next = 0xffffae586d8afe68,
  prev = 0xffffae586d8afe68
}
crash> struct list_head 0xffff9c77b688237c
struct list_head {
  next = 0x0,
  prev = 0x0
}
crash> struct list_head 0xffffae586d8afe68
struct list_head struct: invalid kernel virtual address: ffffae586d8afe68  type: "gdb_readmem_callback"
Cannot access memory at address 0xffffae586d8afe68

[230469.019492] Call Trace:
[230469.032041]  prepare_to_wait+0x8a/0xb0
[230469.044363]  ? bch_btree_keys_free+0x6c/0xc0 [escache]
[230469.056533]  mca_cannibalize_lock+0x72/0x90 [escache]
[230469.068788]  mca_alloc+0x2ae/0x450 [escache]
[230469.080790]  bch_btree_node_get+0x136/0x2d0 [escache]
[230469.092681]  bch_btree_check_thread+0x1e1/0x260 [escache]
[230469.104382]  ? finish_wait+0x80/0x80
[230469.115884]  ? bch_btree_check_recurse+0x1a0/0x1a0 [escache]
[230469.127259]  kthread+0x112/0x130
[230469.138448]  ? kthread_flush_work_fn+0x10/0x10
[230469.149477]  ret_from_fork+0x35/0x40

bch_btree_check_thread() and bch_dirty_init_thread() may call
mca_cannibalize() to cannibalize other cached btree nodes. Only one thread
can do it at a time, so the op of other threads will be added to the
btree_cache_wait list.

We must call finish_wait() to remove op from btree_cache_wait before free
it's memory address. Otherwise, the list will be damaged. Also should call
bch_cannibalize_unlock() to release the btree_cache_alloc_lock and wake_up
other waiters.

Fixes: 8e7102273f ("bcache: make bch_btree_check() to be multithreaded")
Fixes: b144e45fc5 ("bcache: make bch_sectors_dirty_init() to be multithreaded")
Cc: stable@vger.kernel.org
Signed-off-by: Mingzhe Zou <mingzhe.zou@easystack.cn>
Signed-off-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20230615121223.22502-7-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2023-06-15 07:32:55 -06:00
..
alloc.c block: decouple REQ_OP_SECURE_ERASE from REQ_OP_DISCARD 2022-04-17 19:49:59 -06:00
bcache.h bcache: make kobj_type structures constant 2023-06-15 07:30:11 -06:00
bcache_ondisk.h flexible-array transformations for 6.3-rc1 2023-02-25 12:53:42 -08:00
bset.c bcache: bset: Fix comment typos 2022-09-19 11:12:35 -06:00
bset.h bcache: move uapi header bcache.h to bcache code directory 2021-10-29 06:43:21 -06:00
btree.c bcache: fixup btree_cache_wait list damage 2023-06-15 07:32:55 -06:00
btree.h bcache: fixup btree_cache_wait list damage 2023-06-15 07:32:55 -06:00
closure.c bcache: Convert to DEFINE_SHOW_ATTRIBUTE 2020-10-02 14:25:29 -06:00
closure.h bcache: fix typo in code comments of closure_return_with_destructor() 2018-10-08 08:19:43 -06:00
debug.c block: turn bio_kmalloc into a simple kmalloc wrapper 2022-04-17 19:30:41 -06:00
debug.h bcache: add identifier names to arguments of function definitions 2018-08-11 15:46:41 -06:00
extents.c bcache: remove PTR_CACHE 2021-04-11 08:37:55 -06:00
extents.h bcache: add identifier names to arguments of function definitions 2018-08-11 15:46:41 -06:00
features.c bcache: move uapi header bcache.h to bcache code directory 2021-10-29 06:43:21 -06:00
features.h bcache: move uapi header bcache.h to bcache code directory 2021-10-29 06:43:21 -06:00
io.c block: pass a block_device and opf to bio_init 2022-02-02 07:49:59 -07:00
journal.c bcache: Silence memcpy() run-time false positive warnings 2023-01-25 12:24:50 -08:00
journal.h bcache: avoid journal no-space deadlock by reserving 1 journal bucket 2022-05-24 06:19:33 -06:00
Kconfig bcache: remove EXPERIMENTAL for Kconfig option 'Asynchronous device registration' 2022-08-02 17:22:41 -06:00
Makefile bcache: add sysfs file to display feature sets information of cache set 2020-07-25 07:38:21 -06:00
movinggc.c block: remove bio_set_op_attrs 2022-12-07 09:43:12 -07:00
request.c block: replace fmode_t with a block-specific type for block open flags 2023-06-12 08:04:05 -06:00
request.h block: switch polling to be bio based 2021-10-18 06:17:36 -06:00
stats.c bcache: use default_groups in kobj_type 2022-01-26 15:56:18 +01:00
stats.h bcache: Remove dead references to cache_readaheads 2023-06-15 07:30:11 -06:00
super.c bcache: Remove unnecessary NULL point check in node allocations 2023-06-15 07:30:43 -06:00
sysfs.c bcache: Convert to use sysfs_emit()/sysfs_emit_at() APIs 2023-06-15 07:30:11 -06:00
sysfs.h bcache: make kobj_type structures constant 2023-06-15 07:30:11 -06:00
trace.c
util.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
util.h for-5.16/bdev-size-2021-10-29 2021-11-01 09:50:37 -07:00
writeback.c bcache: fixup btree_cache_wait list damage 2023-06-15 07:32:55 -06:00
writeback.h bcache: improve multithreaded bch_sectors_dirty_init() 2022-05-24 06:19:33 -06:00