Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1657240 > unrolled thread

[PATCH] ubifs: Fix a sleep-in-atomic bug in ubifs_read_nnode

Started byJia-Ju Bai <baijiaju1990@163.com>
First post2017-06-05 05:40 +0200
Last post2017-06-05 10:50 +0200
Articles 4 — 2 participants

Back to article view | Back to linux.kernel


Contents

  [PATCH] ubifs: Fix a sleep-in-atomic bug in ubifs_read_nnode Jia-Ju Bai <baijiaju1990@163.com> - 2017-06-05 05:40 +0200
    Re: [PATCH] ubifs: Fix a sleep-in-atomic bug in ubifs_read_nnode Richard Weinberger <richard@nod.at> - 2017-06-05 10:30 +0200
      Re: [PATCH] ubifs: Fix a sleep-in-atomic bug in ubifs_read_nnode Richard Weinberger <richard@nod.at> - 2017-06-05 10:40 +0200
      Re: [PATCH] ubifs: Fix a sleep-in-atomic bug in ubifs_read_nnode Jia-Ju Bai <baijiaju1990@163.com> - 2017-06-05 10:50 +0200

#1657240 — [PATCH] ubifs: Fix a sleep-in-atomic bug in ubifs_read_nnode

FromJia-Ju Bai <baijiaju1990@163.com>
Date2017-06-05 05:40 +0200
Subject[PATCH] ubifs: Fix a sleep-in-atomic bug in ubifs_read_nnode
Message-ID<tOR22-5Sy-13@gated-at.bofh.it>
The driver may sleep under a spin lock, and the function call path is:
ubifs_change_lp (acquire the lock by spin_lock)
  change_category
    ubifs_remove_from_cat
      remove_from_lpt_heap
        dbg_check_heap
          ubifs_lpt_lookup
            ubifs_read_nnode
              kzalloc(GFP_NOFS) --> may sleep

To fix it, "GFP_NOFS" is replaced with "GFP_ATOMIC".

Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
---
 fs/ubifs/lpt.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index 9a51710..4247934c 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -1205,7 +1205,7 @@ int ubifs_read_nnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
 		lnum = c->lpt_lnum;
 		offs = c->lpt_offs;
 	}
-	nnode = kzalloc(sizeof(struct ubifs_nnode), GFP_NOFS);
+	nnode = kzalloc(sizeof(struct ubifs_nnode), GFP_ATOMIC);
 	if (!nnode) {
 		err = -ENOMEM;
 		goto out;
-- 
1.7.9.5

[toc] | [next] | [standalone]


#1657378

FromRichard Weinberger <richard@nod.at>
Date2017-06-05 10:30 +0200
Message-ID<tOVyH-rf-41@gated-at.bofh.it>
In reply to#1657240
Jia-Ju Bai,

Am 05.06.2017 um 05:38 schrieb Jia-Ju Bai:
> The driver may sleep under a spin lock, and the function call path is:
> ubifs_change_lp (acquire the lock by spin_lock)
>   change_category
>     ubifs_remove_from_cat
>       remove_from_lpt_heap
>         dbg_check_heap
>           ubifs_lpt_lookup
>             ubifs_read_nnode
>               kzalloc(GFP_NOFS) --> may sleep
> 
> To fix it, "GFP_NOFS" is replaced with "GFP_ATOMIC".

So, this happens only when dbg_check_heap() is activated, right?

Thanks,
//richard

[toc] | [prev] | [next] | [standalone]


#1657392

FromRichard Weinberger <richard@nod.at>
Date2017-06-05 10:40 +0200
Message-ID<tOVIl-wm-19@gated-at.bofh.it>
In reply to#1657378
Am 05.06.2017 um 10:25 schrieb Richard Weinberger:
> Jia-Ju Bai,
> 
> Am 05.06.2017 um 05:38 schrieb Jia-Ju Bai:
>> The driver may sleep under a spin lock, and the function call path is:
>> ubifs_change_lp (acquire the lock by spin_lock)
>>   change_category
>>     ubifs_remove_from_cat
>>       remove_from_lpt_heap
>>         dbg_check_heap
>>           ubifs_lpt_lookup
>>             ubifs_read_nnode
>>               kzalloc(GFP_NOFS) --> may sleep
>>
>> To fix it, "GFP_NOFS" is replaced with "GFP_ATOMIC".
> 
> So, this happens only when dbg_check_heap() is activated, right?

Why do we call change_category() anyway with c->space_lock held?

Thanks,
//richard

[toc] | [prev] | [next] | [standalone]


#1657398

FromJia-Ju Bai <baijiaju1990@163.com>
Date2017-06-05 10:50 +0200
Message-ID<tOVS2-Bi-23@gated-at.bofh.it>
In reply to#1657378
On 06/05/2017 04:25 PM, Richard Weinberger wrote:
> Jia-Ju Bai,
>
> Am 05.06.2017 um 05:38 schrieb Jia-Ju Bai:
>> The driver may sleep under a spin lock, and the function call path is:
>> ubifs_change_lp (acquire the lock by spin_lock)
>>    change_category
>>      ubifs_remove_from_cat
>>        remove_from_lpt_heap
>>          dbg_check_heap
>>            ubifs_lpt_lookup
>>              ubifs_read_nnode
>>                kzalloc(GFP_NOFS) -->  may sleep
>>
>> To fix it, "GFP_NOFS" is replaced with "GFP_ATOMIC".
> So, this happens only when dbg_check_heap() is activated, right?
>
> Thanks,
> //richard
Yes, I think so.

Thanks,
Jia-Ju Bai

[toc] | [prev] | [standalone]


Back to top | Article view | linux.kernel


csiph-web