Tang Junhui 3d0dca33a2 bcache: fix kcrashes with fio in RAID5 backend dev ... [ Upstream commit 60eb34ec5526e264c2bbaea4f7512d714d791caf ] Kernel crashed when run fio in a RAID5 backend bcache device, the call trace is bellow: [ 440.012034] kernel BUG at block/blk-ioc.c:146! [ 440.012696] invalid opcode: 0000 [#1] SMP NOPTI [ 440.026537] CPU: 2 PID: 2205 Comm: md127_raid5 Not tainted 4.15.0 #8 [ 440.027441] Hardware name: HP ProLiant MicroServer Gen8, BIOS J06 07/16 /2015 [ 440.028615] RIP: 0010:put_io_context+0x8b/0x90 [ 440.029246] RSP: 0018:ffffa8c882b43af8 EFLAGS: 00010246 [ 440.029990] RAX: 0000000000000000 RBX: ffffa8c88294fca0 RCX: 0000000000 0f4240 [ 440.031006] RDX: 0000000000000004 RSI: 0000000000000286 RDI: ffffa8c882 94fca0 [ 440.032030] RBP: ffffa8c882b43b10 R08: 0000000000000003 R09: ffff949cb8 0c1700 [ 440.033206] R10: 0000000000000104 R11: 000000000000b71c R12: 00000000000 01000 [ 440.034222] R13: 0000000000000000 R14: ffff949cad84db70 R15: ffff949cb11 bd1e0 [ 440.035239] FS: 0000000000000000(0000) GS:ffff949cba280000(0000) knlGS: 0000000000000000 [ 440.060190] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 440.084967] CR2: 00007ff0493ef000 CR3: 00000002f1e0a002 CR4: 00000000001 606e0 [ 440.110498] Call Trace: [ 440.135443] bio_disassociate_task+0x1b/0x60 [ 440.160355] bio_free+0x1b/0x60 [ 440.184666] bio_put+0x23/0x30 [ 440.208272] search_free+0x23/0x40 [bcache] [ 440.231448] cached_dev_write_complete+0x31/0x70 [bcache] [ 440.254468] closure_put+0xb6/0xd0 [bcache] [ 440.277087] request_endio+0x30/0x40 [bcache] [ 440.298703] bio_endio+0xa1/0x120 [ 440.319644] handle_stripe+0x418/0x2270 [raid456] [ 440.340614] ? load_balance+0x17b/0x9c0 [ 440.360506] handle_active_stripes.isra.58+0x387/0x5a0 [raid456] [ 440.380675] ? __release_stripe+0x15/0x20 [raid456] [ 440.400132] raid5d+0x3ed/0x5d0 [raid456] [ 440.419193] ? schedule+0x36/0x80 [ 440.437932] ? schedule_timeout+0x1d2/0x2f0 [ 440.456136] md_thread+0x122/0x150 [ 440.473687] ? wait_woken+0x80/0x80 [ 440.491411] kthread+0x102/0x140 [ 440.508636] ? find_pers+0x70/0x70 [ 440.524927] ? kthread_associate_blkcg+0xa0/0xa0 [ 440.541791] ret_from_fork+0x35/0x40 [ 440.558020] Code: c2 48 00 5b 41 5c 41 5d 5d c3 48 89 c6 4c 89 e7 e8 bb c2 48 00 48 8b 3d bc 36 4b 01 48 89 de e8 7c f7 e0 ff 5b 41 5c 41 5d 5d c3 <0f> 0b 0f 1f 00 0f 1f 44 00 00 55 48 8d 47 b8 48 89 e5 41 57 41 [ 440.610020] RIP: put_io_context+0x8b/0x90 RSP: ffffa8c882b43af8 [ 440.628575] ---[ end trace a1fd79d85643a73e ]-- All the crash issue happened when a bypass IO coming, in such scenario s->iop.bio is pointed to the s->orig_bio. In search_free(), it finishes the s->orig_bio by calling bio_complete(), and after that, s->iop.bio became invalid, then kernel would crash when calling bio_put(). Maybe its upper layer's faulty, since bio should not be freed before we calling bio_put(), but we'd better calling bio_put() first before calling bio_complete() to notify upper layer ending this bio. This patch moves bio_complete() under bio_put() to avoid kernel crash. [mlyle: fixed commit subject for character limits] Reported-by: Matthias Ferdinand <bcache@mfedv.net> Tested-by: Matthias Ferdinand <bcache@mfedv.net> Signed-off-by: Tang Junhui <tang.junhui@zte.com.cn> Reviewed-by: Michael Lyle <mlyle@lyle.org> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-05-30 07:49:02 +02:00
..
bcache	bcache: fix kcrashes with fio in RAID5 backend dev	2018-05-30 07:49:02 +02:00
persistent-data	dm btree: fix serious bug in btree_split_beneath()	2018-01-23 19:50:16 +01:00
bitmap.c	md/bitmap: disable bitmap_resize for file-backed bitmaps.	2017-09-27 11:00:14 +02:00
bitmap.h
dm-bio-prison.c
dm-bio-prison.h
dm-bio-record.h
dm-bufio.c	dm bufio: fix shrinker scans when (nr_to_scan < retain_target)	2018-01-17 09:35:24 +01:00
dm-bufio.h
dm-builtin.c
dm-cache-block-types.h
dm-cache-metadata.c	dm cache metadata: fail operations if fail_io mode has been established	2017-05-25 14:30:08 +02:00
dm-cache-metadata.h
dm-cache-policy-cleaner.c
dm-cache-policy-internal.h
dm-cache-policy-mq.c
dm-cache-policy-smq.c
dm-cache-policy.c
dm-cache-policy.h
dm-cache-target.c	dm cache: fix corruption seen when using cache > 2TB	2017-03-12 06:37:26 +01:00
dm-crypt.c	dm crypt: mark key as invalid until properly loaded	2017-01-06 11:16:15 +01:00
dm-delay.c
dm-era-target.c	dm era: save spacemap metadata root after the pre-commit	2017-05-20 14:27:00 +02:00
dm-exception-store.c
dm-exception-store.h
dm-flakey.c	dm flakey: return -EINVAL on interval bounds error in flakey_ctr()	2017-01-06 11:16:15 +01:00
dm-io.c	dm io: fix duplicate bio completion due to missing ref count	2018-03-11 16:19:47 +01:00
dm-ioctl.c	dm ioctl: remove double parentheses	2018-04-08 11:51:57 +02:00
dm-kcopyd.c
dm-linear.c
dm-log-userspace-base.c
dm-log-userspace-transfer.c
dm-log-userspace-transfer.h
dm-log-writes.c	dm log writes: fix bug with too large bios	2016-10-07 15:23:47 +02:00
dm-log.c
dm-mpath.c	dm mpath: check if path's request_queue is dying in activate_path()	2016-10-28 03:01:28 -04:00
dm-mpath.h
dm-path-selector.c
dm-path-selector.h
dm-queue-length.c
dm-raid.c
dm-raid1.c	dm mirror: fix read error on recovery after default leg failure	2016-11-10 16:36:35 +01:00
dm-region-hash.c
dm-round-robin.c
dm-service-time.c
dm-snap-persistent.c
dm-snap-transient.c
dm-snap.c
dm-stats.c	dm stats: fix a leaked s->histogram_boundaries array	2017-03-12 06:37:26 +01:00
dm-stats.h
dm-stripe.c
dm-switch.c
dm-sysfs.c
dm-table.c
dm-target.c
dm-thin-metadata.c	dm thin metadata: THIN_MAX_CONCURRENT_LOCKS should be 6	2018-01-23 19:50:17 +01:00
dm-thin-metadata.h
dm-thin.c
dm-uevent.c
dm-uevent.h
dm-verity.c
dm-zero.c
dm.c	dm: correctly handle chained bios in dec_pending()	2018-02-22 15:45:01 +01:00
dm.h
faulty.c
Kconfig	dm raid: select the Kconfig option CONFIG_MD_RAID0	2017-05-25 14:30:07 +02:00
linear.c	md/linear: shutup lockdep warnning	2017-10-21 17:09:05 +02:00
linear.h	md linear: fix a race between linear_add() and linear_congested()	2017-03-12 06:37:30 +01:00
Makefile
md-cluster.c	md-cluster: fix potential lock issue in add_new_disk	2018-04-13 19:50:09 +02:00
md-cluster.h
md.c	md: avoid warning for 32-bit sector_t	2018-02-25 11:03:44 +01:00
md.h
multipath.c
multipath.h
raid0.c
raid0.h
raid1.c	md/raid1: fix NULL pointer dereference	2018-05-30 07:49:01 +02:00
raid1.h
raid5-cache.c
raid5.c	md: raid5: avoid string overflow warning	2018-05-30 07:49:00 +02:00
raid5.h
raid10.c	md raid10: fix NULL deference in handle_write_completed()	2018-05-30 07:48:59 +02:00
raid10.h