From patchwork Wed Oct 19 08:30:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 5149 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp253380wrs; Wed, 19 Oct 2022 03:57:07 -0700 (PDT) X-Google-Smtp-Source: AMsMyM451dgKewnOCS7qy3Gd8aRioC3dYT2RTX+dBWgfqY5XtoJizygP8qKXcksa3XtM3hMu7FiR X-Received: by 2002:a17:907:1deb:b0:78d:4a0e:f654 with SMTP id og43-20020a1709071deb00b0078d4a0ef654mr6289436ejc.757.1666177026949; Wed, 19 Oct 2022 03:57:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666177026; cv=none; d=google.com; s=arc-20160816; b=WN+SrqS+qU5HR+tiUOjg0Ui4vKYxkLgfuU9Ky2wXcWAB/u87ujvk5Ux05W+w1W4P8e /RoknxuL4IM3VP/AmCa5i/I+MnCW+j73lG902k/kK+GPdUF1jQN5aSFKIdu6kCz5cXNO ULrR/H044RSRLcC3p/R/T7DEvhjFQgygvxKjIa4hYXSOR1gZf6BUzgD+z+cQR/jkaQ1J te0X+uGFGedJfxiBe1opZhlxGeJYv8qGowuwQgzJWl3QWsQ4TSdiuJ1ctQjucil745my YjXHAhI84QNDBqgoBDw75P1NV2Jr2HSJ9aUsKUJFQM7cGOGzVBigda/Z1yYokOXLw4MP UAjQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=dAvZM9bRa5mRzE4EHqZ/ch/ZhUbu3EHYD+WWakCbpkk=; b=Ckp40UrG5Yxc6RAGTd+fh8zdan4k55xvyV6wHNrc4mcEobub+b37d8vXQ5u581Lf8i ktyHhn5N7aifoSwUnvainefAdRMcuwrUk4p8OmJWJA44JkBOOCn4QeHwnmmuaFPot2L+ VR5uriyrmiukrilFZ2TygUSZwVYc7K6wxi3BPf9pr4W9cVcuJEFjVEgTOJ41P5oPwfeK ZoifzHqQFv5VetR9sVWUX8gDTEzfoYxGVklpWf3QMl8Lur2pfkXlwM4+W+iW923OaEZr Kh99JqnsKSH5rB6H2o/OX3eZfPIPT5tfEfdm5IT4TBrkEt2dDaAd9+g5k74gfRJ2jUuo DrEg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=gGDjCYZ8; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id r23-20020a170906365700b0077951929341si12239333ejb.312.2022.10.19.03.56.40; Wed, 19 Oct 2022 03:57:06 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=gGDjCYZ8; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231582AbiJSK4L (ORCPT + 99 others); Wed, 19 Oct 2022 06:56:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52512 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235164AbiJSKzU (ORCPT ); Wed, 19 Oct 2022 06:55:20 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CCC25164BD3; Wed, 19 Oct 2022 03:27:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 4B7CCCE20FF; Wed, 19 Oct 2022 09:02:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B7FEC433D6; Wed, 19 Oct 2022 09:02:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666170161; bh=xQdewhot8li4sCHLPZ88DG2+NEfVO7ps6WCDAPXebyU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gGDjCYZ8ZgZ6uHJuEdDDyzH8pFHHHmx1KlcNXlscixU5qxB+k1JqN75HnJiEh3w0W kdvqBSsXFI4zN2oWr/AhzxQc1mcmeTEbcV5GFHyGCEKVUFZnJ3He1/VErcWxpHQ3E0 JV5Zgyzx0XdudFugToso9uoMEhbhUjtjFfhthLLY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Sloan , Logan Gunthorpe , Christoph Hellwig , Guoqing Jiang , Song Liu , Sasha Levin Subject: [PATCH 6.0 549/862] md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk() Date: Wed, 19 Oct 2022 10:30:36 +0200 Message-Id: <20221019083314.222334258@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221019083249.951566199@linuxfoundation.org> References: <20221019083249.951566199@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747113241961261930?= X-GMAIL-MSGID: =?utf-8?q?1747113241961261930?= From: David Sloan [ Upstream commit c66a6f41e09ad386fd2cce22b9cded837bbbc704 ] When running chunk-sized reads on disks with badblocks duplicate bio free/puts are observed: ============================================================================= BUG bio-200 (Not tainted): Object already free ----------------------------------------------------------------------------- Allocated in mempool_alloc_slab+0x17/0x20 age=3 cpu=2 pid=7504 __slab_alloc.constprop.0+0x5a/0xb0 kmem_cache_alloc+0x31e/0x330 mempool_alloc_slab+0x17/0x20 mempool_alloc+0x100/0x2b0 bio_alloc_bioset+0x181/0x460 do_mpage_readpage+0x776/0xd00 mpage_readahead+0x166/0x320 blkdev_readahead+0x15/0x20 read_pages+0x13f/0x5f0 page_cache_ra_unbounded+0x18d/0x220 force_page_cache_ra+0x181/0x1c0 page_cache_sync_ra+0x65/0xb0 filemap_get_pages+0x1df/0xaf0 filemap_read+0x1e1/0x700 blkdev_read_iter+0x1e5/0x330 vfs_read+0x42a/0x570 Freed in mempool_free_slab+0x17/0x20 age=3 cpu=2 pid=7504 kmem_cache_free+0x46d/0x490 mempool_free_slab+0x17/0x20 mempool_free+0x66/0x190 bio_free+0x78/0x90 bio_put+0x100/0x1a0 raid5_make_request+0x2259/0x2450 md_handle_request+0x402/0x600 md_submit_bio+0xd9/0x120 __submit_bio+0x11f/0x1b0 submit_bio_noacct_nocheck+0x204/0x480 submit_bio_noacct+0x32e/0xc70 submit_bio+0x98/0x1a0 mpage_readahead+0x250/0x320 blkdev_readahead+0x15/0x20 read_pages+0x13f/0x5f0 page_cache_ra_unbounded+0x18d/0x220 Slab 0xffffea000481b600 objects=21 used=0 fp=0xffff8881206d8940 flags=0x17ffffc0010201(locked|slab|head|node=0|zone=2|lastcpupid=0x1fffff) CPU: 0 PID: 34525 Comm: kworker/u24:2 Not tainted 6.0.0-rc2-localyes-265166-gf11c5343fa3f #143 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: raid5wq raid5_do_work Call Trace: dump_stack_lvl+0x5a/0x78 dump_stack+0x10/0x16 print_trailer+0x158/0x165 object_err+0x35/0x50 free_debug_processing.cold+0xb7/0xbe __slab_free+0x1ae/0x330 kmem_cache_free+0x46d/0x490 mempool_free_slab+0x17/0x20 mempool_free+0x66/0x190 bio_free+0x78/0x90 bio_put+0x100/0x1a0 mpage_end_io+0x36/0x150 bio_endio+0x2fd/0x360 md_end_io_acct+0x7e/0x90 bio_endio+0x2fd/0x360 handle_failed_stripe+0x960/0xb80 handle_stripe+0x1348/0x3760 handle_active_stripes.constprop.0+0x72a/0xaf0 raid5_do_work+0x177/0x330 process_one_work+0x616/0xb20 worker_thread+0x2bd/0x6f0 kthread+0x179/0x1b0 ret_from_fork+0x22/0x30 The double free is caused by an unnecessary bio_put() in the if(is_badblock(...)) error path in raid5_read_one_chunk(). The error path was moved ahead of bio_alloc_clone() in c82aa1b76787c ("md/raid5: move checking badblock before clone bio in raid5_read_one_chunk"). The previous code checked and freed align_bio which required a bio_put. After the move that is no longer needed as raid_bio is returned to the control of the common io path which performs its own endio resulting in a double free on bad device blocks. Fixes: c82aa1b76787c ("md/raid5: move checking badblock before clone bio in raid5_read_one_chunk") Signed-off-by: David Sloan Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Acked-by: Guoqing Jiang Signed-off-by: Song Liu Signed-off-by: Sasha Levin --- drivers/md/raid5.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index 4ec33fd62018..db149d28f639 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -5542,7 +5542,6 @@ static int raid5_read_one_chunk(struct mddev *mddev, struct bio *raid_bio) if (is_badblock(rdev, sector, bio_sectors(raid_bio), &first_bad, &bad_sectors)) { - bio_put(raid_bio); rdev_dec_pending(rdev, mddev); return 0; }