From patchwork Sat Oct 22 07:25:20 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 7475 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4242:0:0:0:0:0 with SMTP id s2csp1099188wrr; Sat, 22 Oct 2022 01:12:55 -0700 (PDT) X-Google-Smtp-Source: AMsMyM5yFL/gQeACh0Oj65/XkZL/c/H1N6W+8+oMGv/kkhTN6Okm5TlvRZ2RnLENFxw2b9gDRNRv X-Received: by 2002:a17:90b:4c45:b0:20d:4ead:6e3b with SMTP id np5-20020a17090b4c4500b0020d4ead6e3bmr27452637pjb.76.1666426375083; Sat, 22 Oct 2022 01:12:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666426375; cv=none; d=google.com; s=arc-20160816; b=tne3MZqynhJb4bmNbsLMuYtxe6cL9Q5eak0+RQp//D+8LFJHjBtkKjnb9aOYeKrBhp cSMj5xlTl22QW5vMajBgG9/TIwMffNeTR0vEGjOEqqslKrTjY/Gsc/d0L/CI4XfZaQ1C K2HD6a2I0luNpwxxSP3UsuaLueqIXyIm6vbE9oizxtg3/1hEovqNXTHg4P2maggOVqUh h6k1ozEBaW2NAJ1RcsNMDRCAaYeXPSEvQ8l1B0kKQ1WfRwccokGnLQfCaaH699Rr0jx4 qU1TZcm6akCoHNMvgrZnrfK/BMKlg8EFYZW2BxVmFiMFTeNwqjobP+FG3kR8+pCQuu0U gj9A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=xJvKh8IasxDDkrZfCUukauT355MX79q4JM7JKGRtm3k=; b=k5VftxcItEoWJSxpnBQJ1JxIfQgij63Sfny2H5XHZGIF74g29E3cWX6lkrzG0/QFt+ 4HGIAyyL5ePTgNZAiB2FNKH08HSJ8xgjWdwKNGrRMfZ4K6VmF3sHLm0rUYbi2Pp1HZ3C 09Kd4QEAYfIA+UjQoeiSaxq42RTFVZJwTaveSZC9d9Wqv+ddukI7GowbX9B5YvimjzVj z8HxdF5dxZx7WMIjac3OFexcTzXzTsFKQxgVsSSboFrMymKhceKuDKHUkjpxm/X4VI7c x1tuuuM4nUFnXHawRc2ZPNA5DBOzNUdVqdm+O1seGM0zUZiPbg2aNHrx2xqkdPZqoho+ qqwA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=lYUcQ4DK; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id q13-20020a17090311cd00b00172f8a4b3e1si30823326plh.81.2022.10.22.01.12.42; Sat, 22 Oct 2022 01:12:55 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=lYUcQ4DK; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232975AbiJVIMQ (ORCPT + 99 others); Sat, 22 Oct 2022 04:12:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37532 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233514AbiJVIKE (ORCPT ); Sat, 22 Oct 2022 04:10:04 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D7ECF360B8; Sat, 22 Oct 2022 00:54:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 311E260B83; Sat, 22 Oct 2022 07:54:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 244A7C433C1; Sat, 22 Oct 2022 07:54:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666425252; bh=YcStJxjHg0fqIvmWcwiT7jzTU68fC8sbWFU0pppjLsA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lYUcQ4DKKYexnB1Cbt0VJmia5xka5gBhoEiJ8pRsFKQYHYuQ87XCztb/QI6x8Epm2 9+1C3IXw8UH7Xa2hRtCWELdR0iJIB3mPgHJWzorU7W1Sjvfi3SgMFiTqQvlR6KXYfS LtYfibP5t2OWIWfLLBZLiWByOQwPDFhzIBVDgako= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Sloan , Logan Gunthorpe , Christoph Hellwig , Guoqing Jiang , Song Liu , Sasha Levin Subject: [PATCH 5.19 441/717] md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk() Date: Sat, 22 Oct 2022 09:25:20 +0200 Message-Id: <20221022072517.827549241@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221022072415.034382448@linuxfoundation.org> References: <20221022072415.034382448@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747374702651548926?= X-GMAIL-MSGID: =?utf-8?q?1747374702651548926?= From: David Sloan [ Upstream commit c66a6f41e09ad386fd2cce22b9cded837bbbc704 ] When running chunk-sized reads on disks with badblocks duplicate bio free/puts are observed: ============================================================================= BUG bio-200 (Not tainted): Object already free ----------------------------------------------------------------------------- Allocated in mempool_alloc_slab+0x17/0x20 age=3 cpu=2 pid=7504 __slab_alloc.constprop.0+0x5a/0xb0 kmem_cache_alloc+0x31e/0x330 mempool_alloc_slab+0x17/0x20 mempool_alloc+0x100/0x2b0 bio_alloc_bioset+0x181/0x460 do_mpage_readpage+0x776/0xd00 mpage_readahead+0x166/0x320 blkdev_readahead+0x15/0x20 read_pages+0x13f/0x5f0 page_cache_ra_unbounded+0x18d/0x220 force_page_cache_ra+0x181/0x1c0 page_cache_sync_ra+0x65/0xb0 filemap_get_pages+0x1df/0xaf0 filemap_read+0x1e1/0x700 blkdev_read_iter+0x1e5/0x330 vfs_read+0x42a/0x570 Freed in mempool_free_slab+0x17/0x20 age=3 cpu=2 pid=7504 kmem_cache_free+0x46d/0x490 mempool_free_slab+0x17/0x20 mempool_free+0x66/0x190 bio_free+0x78/0x90 bio_put+0x100/0x1a0 raid5_make_request+0x2259/0x2450 md_handle_request+0x402/0x600 md_submit_bio+0xd9/0x120 __submit_bio+0x11f/0x1b0 submit_bio_noacct_nocheck+0x204/0x480 submit_bio_noacct+0x32e/0xc70 submit_bio+0x98/0x1a0 mpage_readahead+0x250/0x320 blkdev_readahead+0x15/0x20 read_pages+0x13f/0x5f0 page_cache_ra_unbounded+0x18d/0x220 Slab 0xffffea000481b600 objects=21 used=0 fp=0xffff8881206d8940 flags=0x17ffffc0010201(locked|slab|head|node=0|zone=2|lastcpupid=0x1fffff) CPU: 0 PID: 34525 Comm: kworker/u24:2 Not tainted 6.0.0-rc2-localyes-265166-gf11c5343fa3f #143 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: raid5wq raid5_do_work Call Trace: dump_stack_lvl+0x5a/0x78 dump_stack+0x10/0x16 print_trailer+0x158/0x165 object_err+0x35/0x50 free_debug_processing.cold+0xb7/0xbe __slab_free+0x1ae/0x330 kmem_cache_free+0x46d/0x490 mempool_free_slab+0x17/0x20 mempool_free+0x66/0x190 bio_free+0x78/0x90 bio_put+0x100/0x1a0 mpage_end_io+0x36/0x150 bio_endio+0x2fd/0x360 md_end_io_acct+0x7e/0x90 bio_endio+0x2fd/0x360 handle_failed_stripe+0x960/0xb80 handle_stripe+0x1348/0x3760 handle_active_stripes.constprop.0+0x72a/0xaf0 raid5_do_work+0x177/0x330 process_one_work+0x616/0xb20 worker_thread+0x2bd/0x6f0 kthread+0x179/0x1b0 ret_from_fork+0x22/0x30 The double free is caused by an unnecessary bio_put() in the if(is_badblock(...)) error path in raid5_read_one_chunk(). The error path was moved ahead of bio_alloc_clone() in c82aa1b76787c ("md/raid5: move checking badblock before clone bio in raid5_read_one_chunk"). The previous code checked and freed align_bio which required a bio_put. After the move that is no longer needed as raid_bio is returned to the control of the common io path which performs its own endio resulting in a double free on bad device blocks. Fixes: c82aa1b76787c ("md/raid5: move checking badblock before clone bio in raid5_read_one_chunk") Signed-off-by: David Sloan Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Acked-by: Guoqing Jiang Signed-off-by: Song Liu Signed-off-by: Sasha Levin --- drivers/md/raid5.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index d6cad962669a..f498bd4af8c2 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -5446,7 +5446,6 @@ static int raid5_read_one_chunk(struct mddev *mddev, struct bio *raid_bio) if (is_badblock(rdev, sector, bio_sectors(raid_bio), &first_bad, &bad_sectors)) { - bio_put(raid_bio); rdev_dec_pending(rdev, mddev); return 0; }