linux_dsm_epyc7002/drivers/block
Damien Le Moal 5d4600017b null_blk: fix command timeout completion handling
[ Upstream commit de3510e52b0a398261271455562458003b8eea62 ]

Memory backed or zoned null block devices may generate actual request
timeout errors due to the submission path being blocked on memory
allocation or zone locking. Unlike fake timeouts or injected timeouts,
the request submission path will call blk_mq_complete_request() or
blk_mq_end_request() for these real timeout errors, causing a double
completion and use after free situation as the block layer timeout
handler executes blk_mq_rq_timed_out() and __blk_mq_free_request() in
blk_mq_check_expired(). This problem often triggers a NULL pointer
dereference such as:

BUG: kernel NULL pointer dereference, address: 0000000000000050
RIP: 0010:blk_mq_sched_mark_restart_hctx+0x5/0x20
...
Call Trace:
  dd_finish_request+0x56/0x80
  blk_mq_free_request+0x37/0x130
  null_handle_cmd+0xbf/0x250 [null_blk]
  ? null_queue_rq+0x67/0xd0 [null_blk]
  blk_mq_dispatch_rq_list+0x122/0x850
  __blk_mq_do_dispatch_sched+0xbb/0x2c0
  __blk_mq_sched_dispatch_requests+0x13d/0x190
  blk_mq_sched_dispatch_requests+0x30/0x60
  __blk_mq_run_hw_queue+0x49/0x90
  process_one_work+0x26c/0x580
  worker_thread+0x55/0x3c0
  ? process_one_work+0x580/0x580
  kthread+0x134/0x150
  ? kthread_create_worker_on_cpu+0x70/0x70
  ret_from_fork+0x1f/0x30

This problem very often triggers when running the full btrfs xfstests
on a memory-backed zoned null block device in a VM with limited amount
of memory.

Avoid this by executing blk_mq_complete_request() in null_timeout_rq()
only for commands that are marked for a fake timeout completion using
the fake_timeout boolean in struct null_cmd. For timeout errors injected
through debugfs, the timeout handler will execute
blk_mq_complete_request()i as before. This is safe as the submission
path does not execute complete requests in this case.

In null_timeout_rq(), also make sure to set the command error field to
BLK_STS_TIMEOUT and to propagate this error through to the request
completion.

Reported-by: Johannes Thumshirn <Johannes.Thumshirn@wdc.com>
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Tested-by: Johannes Thumshirn <Johannes.Thumshirn@wdc.com>
Reviewed-by: Johannes Thumshirn <Johannes.Thumshirn@wdc.com>
Link: https://lore.kernel.org/r/20210331225244.126426-1-damien.lemoal@wdc.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-04-16 11:43:21 +02:00
..
aoe block: lift setting the readahead size into the block layer 2020-09-24 13:43:39 -06:00
drbd block-5.10-2020-10-12 2020-10-13 12:12:44 -07:00
mtip32xx blk-mq: move failure injection out of blk_mq_complete_request 2020-06-24 09:15:57 -06:00
paride paride/pcd: use bdev_check_media_change 2020-09-10 09:32:31 -06:00
rnbd block/rnbd-clt: avoid module unload race with close confirmation 2021-01-17 14:17:05 +01:00
rsxx block: rsxx: fix error return code of rsxx_pci_probe() 2021-03-17 17:06:33 +01:00
xen-blkback xen-blkback: don't leak persistent grants from xen_blkbk_map() 2021-03-30 14:32:09 +02:00
zram zram: fix return value on writeback_store 2021-03-17 17:06:34 +01:00
amiflop.c amiflop: use bdev_check_media_change 2020-09-10 09:32:30 -06:00
ataflop.c ataflop: use bdev_check_media_change 2020-09-10 09:32:30 -06:00
brd.c bdi: remove BDI_CAP_SYNCHRONOUS_IO 2020-09-24 13:43:39 -06:00
cryptoloop.c
floppy.c floppy: reintroduce O_NDELAY fix 2021-03-04 11:38:33 +01:00
Kconfig block: rsxx: select CONFIG_CRC32 2021-01-17 14:17:03 +01:00
loop.c loop: Fix occasional uevent drop 2020-11-12 13:59:04 -07:00
loop.h
Makefile
nbd.c nbd: handle device refs for DESTROY_ON_DISCONNECT properly 2021-03-07 12:34:06 +01:00
null_blk_main.c null_blk: fix command timeout completion handling 2021-04-16 11:43:21 +02:00
null_blk_trace.c
null_blk_trace.h
null_blk_zoned.c null_blk: Fail zone append to conventional zones 2020-12-30 11:54:29 +01:00
null_blk.h null_blk: fix command timeout completion handling 2021-04-16 11:43:21 +02:00
pktcdvd.c pktcdvd: use blkdev_get_by_dev instead of open coding it 2020-09-23 10:43:19 -06:00
ps3disk.c
ps3vram.c block: move ->make_request_fn to struct block_device_operations 2020-07-01 07:27:24 -06:00
rbd_types.h
rbd.c We have: 2020-10-21 10:34:10 -07:00
skd_main.c skd_main: remove unused including <linux/version.h> 2020-10-17 08:11:14 -06:00
skd_s1120.h
sunvdc.c
swim3.c swim3: use bdev_check_media_changed 2020-09-10 09:32:31 -06:00
swim_asm.S
swim.c swim: simplify media change handling 2020-09-10 09:32:30 -06:00
sx8.c
umem.c umem: fix error return code in mm_pci_probe() 2021-03-30 14:31:50 +02:00
umem.h
virtio_blk.c block: add a new revalidate_disk_size helper 2020-09-02 08:00:07 -06:00
xen-blkfront.c xen-blkfront: allow discard-* nodes to be optional 2021-02-03 23:28:44 +01:00
xsysace.c xsysace: use platform_get_resource() and platform_get_irq_optional() 2020-10-29 08:22:33 -06:00
z2ram.c mm: reorder includes after introduction of linux/pgtable.h 2020-06-09 09:39:13 -07:00