Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1537552

[PATCH 4.8 08/35] zram: fix unbalanced idr management at hot removal

Show all headers | View raw

4.8-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 529e71e16403830ae0d737a66c55c5f360f3576b upstream.

The zram hot removal code calls idr_remove() even when zram_remove()
returns an error (typically -EBUSY).  This results in a leftover at the
device release, eventually leading to a crash when the module is
reloaded.

As described in the bug report below, the following procedure would
cause an Oops with zram:

 - provision three zram devices via modprobe zram num_devices=3
 - configure a size for each device
   + echo "1G" > /sys/block/$zram_name/disksize
 - mkfs and mount zram0 only
 - attempt to hot remove all three devices
   + echo 2 > /sys/class/zram-control/hot_remove
   + echo 1 > /sys/class/zram-control/hot_remove
   + echo 0 > /sys/class/zram-control/hot_remove
     - zram0 removal fails with EBUSY, as expected
 - unmount zram0
 - try zram0 hot remove again
   + echo 0 > /sys/class/zram-control/hot_remove
     - fails with ENODEV (unexpected)
 - unload zram kernel module
   + completes successfully
 - zram0 device node still exists
 - attempt to mount /dev/zram0
   + mount command is killed
   + following BUG is encountered

 BUG: unable to handle kernel paging request at ffffffffa0002ba0
 IP: get_disk+0x16/0x50
 Oops: 0000 [#1] SMP
 CPU: 0 PID: 252 Comm: mount Not tainted 4.9.0-rc6 #176
 Call Trace:
   exact_lock+0xc/0x20
   kobj_lookup+0xdc/0x160
   get_gendisk+0x2f/0x110
   __blkdev_get+0x10c/0x3c0
   blkdev_get+0x19d/0x2e0
   blkdev_open+0x56/0x70
   do_dentry_open.isra.19+0x1ff/0x310
   vfs_open+0x43/0x60
   path_openat+0x2c9/0xf30
   do_filp_open+0x79/0xd0
   do_sys_open+0x114/0x1e0
   SyS_open+0x19/0x20
   entry_SYSCALL_64_fastpath+0x13/0x94

This patch adds the proper error check in hot_remove_store() not to call
idr_remove() unconditionally.

Fixes: 17ec4cd98578 ("zram: don't call idr_remove() from zram_remove()")
Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1010970
Link: http://lkml.kernel.org/r/20161121132140.12683-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: David Disseldorp <ddiss@suse.de>
Reported-by: David Disseldorp <ddiss@suse.de>
Tested-by: David Disseldorp <ddiss@suse.de>
Acked-by: Minchan Kim <minchan@kernel.org>
Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/zram/zram_drv.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1403,7 +1403,8 @@ static ssize_t hot_remove_store(struct c
 	zram = idr_find(&zram_index_idr, dev_id);
 	if (zram) {
 		ret = zram_remove(zram);
-		idr_remove(&zram_index_idr, dev_id);
+		if (!ret)
+			idr_remove(&zram_index_idr, dev_id);
 	} else {
 		ret = -ENODEV;
 	}

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.8 00/35] 4.8.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 16/35] PCI: Export pcie_find_root_port Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 11/35] ovl: fix d_real() for stacked fs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 01/35] libata-scsi: Fixup ata_gen_passthru_sense() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 25/35] drm/radeon: fix check for port PM availability Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 14/35] rcu: Fix soft lockup for rcu_nocb_kthread Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 21/35] drm/i915: drop the struct_mutex when wedged or trying to reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 02/35] scsi: hpsa: use bus 3 for legacy HBA devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 23/35] drm/radeon: fix power state when port pm is unavailable (v2) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 26/35] arm64: dts: juno: fix cluster sleep state entry latency on all SoC versions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 07/35] thp: fix corner case of munlock() of PTE-mapped THPs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 10/35] mm: fix false-positive WARN_ON() in truncate/invalidate for hugetlb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 29/35] drm/mediatek: fix null pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 08/35] zram: fix unbalanced idr management at hot removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 35/35] arm64: suspend: Reconfigure PSTATE after resume from idle Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 34/35] arm64: mm: Set PSTATE.PAN from the cpu_enable_pan() call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 04/35] ARC: mm: PAE40: Fix crash at munmap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 24/35] drm/amdgpu: fix check for port PM availability Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 20/35] drm/i915: Dont touch NULL sg on i915_gem_object_get_pages_gtt() error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 05/35] ARC: Dont use "+l" inline asm constraint Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 12/35] Input: change KEY_DATA from 0x275 to 0x277 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 30/35] perf/x86: Restore TASK_SIZE check on frame pointer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 28/35] pwm: Fix device reference leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 03/35] scsi: libfc: fix seconds_since_last_reset miscalculation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 32/35] batman-adv: Detect missing primaryif during tp_send as error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 33/35] arm64: cpufeature: Schedule enable() calls instead of calling them via IPI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 09/35] kasan: update kasan_global for gcc 7 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  Re: [PATCH 4.8 00/35] 4.8.13-stable review Guenter Roeck <linux@roeck-us.net> - 2016-12-07 17:10 +0100
    Re: [PATCH 4.8 00/35] 4.8.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-08 17:30 +0100
  Re: [PATCH 4.8 00/35] 4.8.13-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-12-07 19:20 +0100
    Re: [PATCH 4.8 00/35] 4.8.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-08 17:30 +0100
  Re: [PATCH 4.8 00/35] 4.8.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-08 17:30 +0100

csiph-web