Coly Li de5b20a30b bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush() ... [ Upstream commit b387e9b58679c60f5b1e4313939bd4878204fc37 ] When system memory is in heavy pressure, bch_gc_thread_start() from run_cache_set() may fail due to out of memory. In such condition, c->gc_thread is assigned to -ENOMEM, not NULL pointer. Then in following failure code path bch_cache_set_error(), when cache_set_flush() gets called, the code piece to stop c->gc_thread is broken, if (!IS_ERR_OR_NULL(c->gc_thread)) kthread_stop(c->gc_thread); And KASAN catches such NULL pointer deference problem, with the warning information: [ 561.207881] ================================================================== [ 561.207900] BUG: KASAN: null-ptr-deref in kthread_stop+0x3b/0x440 [ 561.207904] Write of size 4 at addr 000000000000001c by task kworker/15:1/313 [ 561.207913] CPU: 15 PID: 313 Comm: kworker/15:1 Tainted: G W 5.0.0-vanilla+ #3 [ 561.207916] Hardware name: Lenovo ThinkSystem SR650 -[7X05CTO1WW]-/-[7X05CTO1WW]-, BIOS -[IVE136T-2.10]- 03/22/2019 [ 561.207935] Workqueue: events cache_set_flush [bcache] [ 561.207940] Call Trace: [ 561.207948] dump_stack+0x9a/0xeb [ 561.207955] ? kthread_stop+0x3b/0x440 [ 561.207960] ? kthread_stop+0x3b/0x440 [ 561.207965] kasan_report+0x176/0x192 [ 561.207973] ? kthread_stop+0x3b/0x440 [ 561.207981] kthread_stop+0x3b/0x440 [ 561.207995] cache_set_flush+0xd4/0x6d0 [bcache] [ 561.208008] process_one_work+0x856/0x1620 [ 561.208015] ? find_held_lock+0x39/0x1d0 [ 561.208028] ? drain_workqueue+0x380/0x380 [ 561.208048] worker_thread+0x87/0xb80 [ 561.208058] ? __kthread_parkme+0xb6/0x180 [ 561.208067] ? process_one_work+0x1620/0x1620 [ 561.208072] kthread+0x326/0x3e0 [ 561.208079] ? kthread_create_worker_on_cpu+0xc0/0xc0 [ 561.208090] ret_from_fork+0x3a/0x50 [ 561.208110] ================================================================== [ 561.208113] Disabling lock debugging due to kernel taint [ 561.208115] irq event stamp: 11800231 [ 561.208126] hardirqs last enabled at (11800231): [<ffffffff83008538>] do_syscall_64+0x18/0x410 [ 561.208127] BUG: unable to handle kernel NULL pointer dereference at 000000000000001c [ 561.208129] #PF error: [WRITE] [ 561.312253] hardirqs last disabled at (11800230): [<ffffffff830052ff>] trace_hardirqs_off_thunk+0x1a/0x1c [ 561.312259] softirqs last enabled at (11799832): [<ffffffff850005c7>] __do_softirq+0x5c7/0x8c3 [ 561.405975] PGD 0 P4D 0 [ 561.442494] softirqs last disabled at (11799821): [<ffffffff831add2c>] irq_exit+0x1ac/0x1e0 [ 561.791359] Oops: 0002 [#1] SMP KASAN NOPTI [ 561.791362] CPU: 15 PID: 313 Comm: kworker/15:1 Tainted: G B W 5.0.0-vanilla+ #3 [ 561.791363] Hardware name: Lenovo ThinkSystem SR650 -[7X05CTO1WW]-/-[7X05CTO1WW]-, BIOS -[IVE136T-2.10]- 03/22/2019 [ 561.791371] Workqueue: events cache_set_flush [bcache] [ 561.791374] RIP: 0010:kthread_stop+0x3b/0x440 [ 561.791376] Code: 00 00 65 8b 05 26 d5 e0 7c 89 c0 48 0f a3 05 ec aa df 02 0f 82 dc 02 00 00 4c 8d 63 20 be 04 00 00 00 4c 89 e7 e8 65 c5 53 00 <f0> ff 43 20 48 8d 7b 24 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 [ 561.791377] RSP: 0018:ffff88872fc8fd10 EFLAGS: 00010286 [ 561.838895] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree. [ 561.838916] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree. [ 561.838934] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree. [ 561.838948] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree. [ 561.838966] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree. [ 561.838979] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree. [ 561.838996] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree. [ 563.067028] RAX: 0000000000000000 RBX: fffffffffffffffc RCX: ffffffff832dd314 [ 563.067030] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000297 [ 563.067032] RBP: ffff88872fc8fe88 R08: fffffbfff0b8213d R09: fffffbfff0b8213d [ 563.067034] R10: 0000000000000001 R11: fffffbfff0b8213c R12: 000000000000001c [ 563.408618] R13: ffff88dc61cc0f68 R14: ffff888102b94900 R15: ffff88dc61cc0f68 [ 563.408620] FS: 0000000000000000(0000) GS:ffff888f7dc00000(0000) knlGS:0000000000000000 [ 563.408622] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 563.408623] CR2: 000000000000001c CR3: 0000000f48a1a004 CR4: 00000000007606e0 [ 563.408625] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 563.408627] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 563.904795] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree. [ 563.915796] PKRU: 55555554 [ 563.915797] Call Trace: [ 563.915807] cache_set_flush+0xd4/0x6d0 [bcache] [ 563.915812] process_one_work+0x856/0x1620 [ 564.001226] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree. [ 564.033563] ? find_held_lock+0x39/0x1d0 [ 564.033567] ? drain_workqueue+0x380/0x380 [ 564.033574] worker_thread+0x87/0xb80 [ 564.062823] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree. [ 564.118042] ? __kthread_parkme+0xb6/0x180 [ 564.118046] ? process_one_work+0x1620/0x1620 [ 564.118048] kthread+0x326/0x3e0 [ 564.118050] ? kthread_create_worker_on_cpu+0xc0/0xc0 [ 564.167066] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree. [ 564.252441] ret_from_fork+0x3a/0x50 [ 564.252447] Modules linked in: msr rpcrdma sunrpc rdma_ucm ib_iser ib_umad rdma_cm ib_ipoib i40iw configfs iw_cm ib_cm libiscsi scsi_transport_iscsi mlx4_ib ib_uverbs mlx4_en ib_core nls_iso8859_1 nls_cp437 vfat fat intel_rapl skx_edac x86_pkg_temp_thermal coretemp iTCO_wdt iTCO_vendor_support crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel ses raid0 aesni_intel cdc_ether enclosure usbnet ipmi_ssif joydev aes_x86_64 i40e scsi_transport_sas mii bcache md_mod crypto_simd mei_me ioatdma crc64 ptp cryptd pcspkr i2c_i801 mlx4_core glue_helper pps_core mei lpc_ich dca wmi ipmi_si ipmi_devintf nd_pmem dax_pmem nd_btt ipmi_msghandler device_dax pcc_cpufreq button hid_generic usbhid mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect xhci_pci sysimgblt fb_sys_fops xhci_hcd ttm megaraid_sas drm usbcore nfit libnvdimm sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua efivarfs [ 564.299390] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree. [ 564.348360] CR2: 000000000000001c [ 564.348362] ---[ end trace b7f0e5cc7b2103b0 ]--- Therefore, it is not enough to only check whether c->gc_thread is NULL, we should use IS_ERR_OR_NULL() to check both NULL pointer and error value. This patch changes the above buggy code piece in this way, if (!IS_ERR_OR_NULL(c->gc_thread)) kthread_stop(c->gc_thread); Signed-off-by: Coly Li <colyli@suse.de> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-08-04 09:34:48 +02:00
..
bcache	bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush()	2019-08-04 09:34:48 +02:00
persistent-data	dm btree: fix serious bug in btree_split_beneath()	2018-01-23 19:50:16 +01:00
bitmap.c	md/bitmap: disable bitmap_resize for file-backed bitmaps.	2017-09-27 11:00:14 +02:00
bitmap.h	md-cluster: Use a small window for resync	2015-10-12 01:32:05 -05:00
dm-bio-prison.c	block: add a bi_error field to struct bio	2015-07-29 08:55:15 -06:00
dm-bio-prison.h	dm bio prison: add dm_cell_promote_or_release()	2015-05-29 14:19:06 -04:00
dm-bio-record.h
dm-bufio.c	dm bufio: don't take the lock in dm_bufio_shrink_count	2018-07-11 16:03:51 +02:00
dm-bufio.h
dm-builtin.c
dm-cache-block-types.h
dm-cache-metadata.c	dm cache metadata: save in-core policy_hint_size to on-disk superblock	2018-09-09 20:04:33 +02:00
dm-cache-metadata.h	dm cache: make sure every metadata function checks fail_io	2016-04-12 09:08:40 -07:00
dm-cache-policy-cleaner.c	- Revert a dm-multipath change that caused a regression for unprivledged	2015-11-04 21:19:53 -08:00
dm-cache-policy-internal.h	dm cache: age and write back cache entries even without active IO	2015-06-11 17:13:01 -04:00
dm-cache-policy-mq.c	dm: convert ffs to __ffs	2015-10-31 19:06:01 -04:00
dm-cache-policy-smq.c	dm: convert ffs to __ffs	2015-10-31 19:06:01 -04:00
dm-cache-policy.c
dm-cache-policy.h	dm cache: age and write back cache entries even without active IO	2015-06-11 17:13:01 -04:00
dm-cache-target.c	dm cache: fix resize crash if user doesn't reload cache table	2018-10-13 09:11:32 +02:00
dm-crypt.c	dm crypt: mark key as invalid until properly loaded	2017-01-06 11:16:15 +01:00
dm-delay.c	dm delay: fix a crash when invalid device is specified	2019-06-11 12:23:48 +02:00
dm-era-target.c	dm era: save spacemap metadata root after the pre-commit	2017-05-20 14:27:00 +02:00
dm-exception-store.c	- Revert a dm-multipath change that caused a regression for unprivledged	2015-11-04 21:19:53 -08:00
dm-exception-store.h	dm snapshot: fix hung bios when copy error occurs	2016-03-03 15:07:14 -08:00
dm-flakey.c	dm flakey: return -EINVAL on interval bounds error in flakey_ctr()	2017-01-06 11:16:15 +01:00
dm-io.c	dm io: fix duplicate bio completion due to missing ref count	2018-03-11 16:19:47 +01:00
dm-ioctl.c	dm ioctl: harden copy_params()'s copy_from_user() from malicious users	2018-11-21 09:27:36 +01:00
dm-kcopyd.c	dm kcopyd: Fix bug causing workqueue stalls	2019-01-26 09:42:54 +01:00
dm-linear.c	dm linear: remove redundant target name from error messages	2015-10-31 19:06:03 -04:00
dm-log-userspace-base.c	dm: drop NULL test before kmem_cache_destroy() and mempool_destroy()	2015-10-31 19:06:00 -04:00
dm-log-userspace-transfer.c	dm log userspace transfer: match wait_for_completion_timeout return type	2015-04-15 12:10:20 -04:00
dm-log-userspace-transfer.h
dm-log-writes.c	dm log writes: fix bug with too large bios	2016-10-07 15:23:47 +02:00
dm-log.c
dm-mpath.c	dm mpath: check if path's request_queue is dying in activate_path()	2016-10-28 03:01:28 -04:00
dm-mpath.h
dm-path-selector.c
dm-path-selector.h
dm-queue-length.c
dm-raid.c	dm raid: fix round up of default region size	2015-10-02 12:02:31 -04:00
dm-raid1.c	dm mirror: fix read error on recovery after default leg failure	2016-11-10 16:36:35 +01:00
dm-region-hash.c	dm: convert ffs to __ffs	2015-10-31 19:06:01 -04:00
dm-round-robin.c
dm-service-time.c
dm-snap-persistent.c	dm snapshot: fix hung bios when copy error occurs	2016-03-03 15:07:14 -08:00
dm-snap-transient.c	dm snapshot: fix hung bios when copy error occurs	2016-03-03 15:07:14 -08:00
dm-snap.c	dm snapshot: Fix excessive memory usage and workqueue stalls	2019-01-26 09:42:54 +01:00
dm-stats.c	dm stats: fix a leaked s->histogram_boundaries array	2017-03-12 06:37:26 +01:00
dm-stats.h	dm stats: support precise timestamps	2015-06-17 12:40:40 -04:00
dm-stripe.c	Merge tag 'dm-4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm	2015-09-02 16:35:26 -07:00
dm-switch.c	dm switch: simplify conditional in alloc_region_table()	2015-10-31 19:06:06 -04:00
dm-sysfs.c
dm-table.c	dm snapshot: disallow the COW and origin devices from being identical	2016-04-12 09:08:39 -07:00
dm-target.c
dm-thin-metadata.c	dm thin metadata: fix __udivdi3 undefined on 32-bit	2018-10-10 08:52:13 +02:00
dm-thin-metadata.h	dm thin metadata: add dm_thin_remove_range()	2015-06-11 17:13:04 -04:00
dm-thin.c	dm thin: add sanity checks to thin-pool and external snapshot creation	2019-04-27 09:33:49 +02:00
dm-uevent.c
dm-uevent.h
dm-verity.c	dm verity: use message limit for data block corruption message	2019-07-21 09:07:14 +02:00
dm-zero.c	block: add a bi_error field to struct bio	2015-07-29 08:55:15 -06:00
dm.c	dm: correctly handle chained bios in dec_pending()	2018-02-22 15:45:01 +01:00
dm.h	block: kill merge_bvec_fn() completely	2015-08-13 12:31:57 -06:00
faulty.c	block: add a bi_error field to struct bio	2015-07-29 08:55:15 -06:00
Kconfig	dm raid: select the Kconfig option CONFIG_MD_RAID0	2017-05-25 14:30:07 +02:00
linear.c	md/linear: shutup lockdep warnning	2017-10-21 17:09:05 +02:00
linear.h	md linear: fix a race between linear_add() and linear_congested()	2017-03-12 06:37:30 +01:00
Makefile	raid5: add basic stripe log	2015-10-24 17:16:19 +11:00
md-cluster.c	md-cluster: clear another node's suspend_area after the copy is finished	2018-10-10 08:52:04 +02:00
md-cluster.h	md-cluster: Fix adding of new disk with new reload code	2015-10-12 03:35:30 -05:00
md.c	md: fix for divide error in status_resync	2019-07-21 09:07:08 +02:00
md.h	md/raid: only permit hot-add of compatible integrity profiles	2016-02-17 12:30:57 -08:00
multipath.c	md: multipath: don't hardcopy bio in .make_request path	2016-04-12 09:08:57 -07:00
multipath.h
raid0.c	md/raid0: apply base queue limits *before* disk_stack_limits	2015-10-02 17:23:44 +10:00
raid0.h	block: kill merge_bvec_fn() completely	2015-08-13 12:31:57 -06:00
raid1.c	MD: fix invalid stored role for a disk - try2	2018-11-21 09:27:38 +01:00
raid1.h	md-cluster: Use a small window for resync	2015-10-12 01:32:05 -05:00
raid5-cache.c	raid5-cache: start raid5 readonly if journal is missing	2015-11-01 13:48:29 +11:00
raid5.c	md/raid: raid5 preserve the writeback action after the parity check	2019-06-11 12:23:50 +02:00
raid5.h	RAID5: revert e9e4c377e2 to fix a livelock	2016-04-12 09:08:57 -07:00
raid10.c	md: Fix failed allocation of md_register_thread	2019-03-23 08:44:39 +01:00
raid10.h	md/raid10: ensure device failure recorded before write request returns.	2015-08-31 19:43:45 +02:00