linux/drivers/block
Josef Bacik 7ce23e8e0a nbd: handle racing with error'ed out commands
We hit the following warning in production

print_req_error: I/O error, dev nbd0, sector 7213934408 flags 80700
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 25 PID: 32407 at lib/refcount.c:190 refcount_sub_and_test_checked+0x53/0x60
Workqueue: knbd-recv recv_work [nbd]
RIP: 0010:refcount_sub_and_test_checked+0x53/0x60
Call Trace:
 blk_mq_free_request+0xb7/0xf0
 blk_mq_complete_request+0x62/0xf0
 recv_work+0x29/0xa1 [nbd]
 process_one_work+0x1f5/0x3f0
 worker_thread+0x2d/0x3d0
 ? rescuer_thread+0x340/0x340
 kthread+0x111/0x130
 ? kthread_create_on_node+0x60/0x60
 ret_from_fork+0x1f/0x30
---[ end trace b079c3c67f98bb7c ]---

This was preceded by us timing out everything and shutting down the
sockets for the device.  The problem is we had a request in the queue at
the same time, so we completed the request twice.  This can actually
happen in a lot of cases, we fail to get a ref on our config, we only
have one connection and just error out the command, etc.

Fix this by checking cmd->status in nbd_read_stat.  We only change this
under the cmd->lock, so we are safe to check this here and see if we've
already error'ed this command out, which would indicate that we've
completed it as well.

Reviewed-by: Mike Christie <mchristi@redhat.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>

Signed-off-by: Jens Axboe <axboe@kernel.dk>
2019-10-25 14:20:03 -06:00
..
aoe block: aoe: Fix kernel crash due to atomic sleep when exiting 2019-08-08 07:29:02 -06:00
drbd augmented rbtree: add new RB_DECLARE_CALLBACKS_MAX macro 2019-09-25 17:51:39 -07:00
mtip32xx block: mtip32xx: Remove call to memset after dma_alloc_coherent 2019-06-29 09:42:50 -06:00
paride paride/pcd: need to check if cd->disk is null in pcd_detect 2019-09-04 07:04:37 -06:00
rsxx rsxx: don't call dma_set_max_seg_size 2019-06-05 13:18:39 -06:00
xen-blkback xen/blkback: fix memory leaks 2019-08-12 08:18:37 -06:00
zram zram: fix race between backing_dev_show and backing_dev_store 2019-10-19 06:32:32 -04:00
amiflop.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ataflop.c ataflop: Mark expected switch fall-through 2019-07-29 15:24:58 -06:00
brd.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
cryptoloop.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 30 2019-05-24 17:27:10 +02:00
floppy.c floppy: fix usercopy direction 2019-08-09 07:41:36 -06:00
Kconfig docs: blockdev: add it to the admin-guide 2019-07-15 11:03:01 -03:00
loop.c loop: change queue block size to match when using DIO 2019-10-01 09:36:01 -06:00
loop.h block/loop: Use global lock for ioctl() operation. 2018-11-08 06:30:11 -07:00
Makefile drivers/block: Remove DAC960 driver 2018-10-17 09:42:30 -06:00
nbd.c nbd: handle racing with error'ed out commands 2019-10-25 14:20:03 -06:00
null_blk_main.c null_blk: format pr_* logs with pr_fmt 2019-09-16 08:38:29 -06:00
null_blk_zoned.c null_blk: Fix zoned command return code 2019-10-09 21:00:20 -06:00
null_blk.h null_blk: format pr_* logs with pr_fmt 2019-09-16 08:38:29 -06:00
pktcdvd.c pktcdvd: remove warning on attempting to register non-passthrough dev 2019-09-22 10:01:05 -06:00
ps3disk.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 164 2019-05-30 11:26:38 -07:00
ps3vram.c block/ps3vram: Use %llu to format sector_t after LBDAF removal 2019-06-13 03:17:50 -06:00
rbd_types.h rbd: support for object-map and fast-diff 2019-07-08 14:01:45 +02:00
rbd.c rbd: cancel lock_dwork if the wait is interrupted 2019-10-15 17:43:15 +02:00
skd_main.c Linux 5.2-rc6 2019-07-01 08:16:08 -06:00
skd_s1120.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 497 2019-06-19 17:09:53 +02:00
sunvdc.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
swim3.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
swim_asm.S treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
swim.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
sx8.c sx8: use a per-host tag_set 2018-11-09 08:14:14 -07:00
umem.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 349 2019-06-05 17:37:08 +02:00
umem.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 348 2019-06-05 17:37:08 +02:00
virtio_blk.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
xen-blkfront.c xen-blkfront: switch kcalloc to kvcalloc for large array allocation 2019-06-03 22:16:19 -04:00
xsysace.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
z2ram.c powerpc updates for 4.20 2018-10-26 14:36:21 -07:00