Shaohua Li
ed3b98c71c
MD: add rdev reference for super write ...
Xiao Ni reported below crash:
[26396.335146] BUG: unable to handle kernel NULL pointer dereference at 00000000000002a8
[26396.342990] IP: [<ffffffffa0425b00>] super_written+0x20/0x80 [md_mod]
[26396.349449] PGD 0
[26396.351468] Oops: 0002 [#1 ] SMP
[26396.354898] Modules linked in: ext4 mbcache jbd2 raid456 async_raid6_recov async_memcpy async_pq async_xor xor async_td
[26396.408404] CPU: 5 PID: 3261 Comm: loop0 Not tainted 4.5.0 #1
[26396.414140] Hardware name: Dell Inc. PowerEdge R715/0G2DP3, BIOS 3.2.2 09/15/2014
[26396.421608] task: ffff8808339be680 ti: ffff8808365f4000 task.ti: ffff8808365f4000
[26396.429074] RIP: 0010:[<ffffffffa0425b00>] [<ffffffffa0425b00>] super_written+0x20/0x80 [md_mod]
[26396.437952] RSP: 0018:ffff8808365f7c38 EFLAGS: 00010046
[26396.443252] RAX: ffffffffa0425ae0 RBX: ffff8804336a7900 RCX: ffffe8f9f7b41198
[26396.450371] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8804336a7900
[26396.457489] RBP: ffff8808365f7c50 R08: 0000000000000005 R09: 00001801e02ce3d7
[26396.464608] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
[26396.471728] R13: ffff8808338d9a00 R14: 0000000000000000 R15: ffff880833f9fe00
[26396.478849] FS: 00007f9e5066d740(0000) GS:ffff880237b40000(0000) knlGS:0000000000000000
[26396.486922] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[26396.492656] CR2: 00000000000002a8 CR3: 00000000019ea000 CR4: 00000000000006e0
[26396.499775] Stack:
[26396.501781] ffff8804336a7900 0000000000000000 0000000000000000 ffff8808365f7c68
[26396.509199] ffffffff81308cd0 ffff8804336a7900 ffff8808365f7ca8 ffffffff81310637
[26396.516618] 00000000a0233a00 ffff880833f9fe00 0000000000000000 ffff880833fb0000
[26396.524038] Call Trace:
[26396.526485] [<ffffffff81308cd0>] bio_endio+0x40/0x60
[26396.531529] [<ffffffff81310637>] blk_update_request+0x87/0x320
[26396.537439] [<ffffffff8131a20a>] blk_mq_end_request+0x1a/0x70
[26396.543261] [<ffffffff81313889>] blk_flush_complete_seq+0xd9/0x2a0
[26396.549517] [<ffffffff81313ccf>] flush_end_io+0x15f/0x240
[26396.554993] [<ffffffff8131a22a>] blk_mq_end_request+0x3a/0x70
[26396.560815] [<ffffffff8131a314>] __blk_mq_complete_request+0xb4/0xe0
[26396.567246] [<ffffffff8131a35c>] blk_mq_complete_request+0x1c/0x20
[26396.573506] [<ffffffffa04182df>] loop_queue_work+0x6f/0x72c [loop]
[26396.579764] [<ffffffff81697844>] ? __schedule+0x2b4/0x8f0
[26396.585242] [<ffffffff810a7812>] kthread_worker_fn+0x52/0x170
[26396.591065] [<ffffffff810a77c0>] ? kthread_create_on_node+0x1a0/0x1a0
[26396.597582] [<ffffffff810a7238>] kthread+0xd8/0xf0
[26396.602453] [<ffffffff810a7160>] ? kthread_park+0x60/0x60
[26396.607929] [<ffffffff8169bdcf>] ret_from_fork+0x3f/0x70
[26396.613319] [<ffffffff810a7160>] ? kthread_park+0x60/0x60
md_super_write() and corresponding md_super_wait() generally are called
with reconfig_mutex locked, which prevents disk disappears. There is one
case this rule is broken. write_sb_page of bitmap.c doesn't hold the
mutex. next_active_rdev does increase rdev reference, but it decreases
the reference too early (eg, before IO finish). disk can disappear at
the window. We unconditionally increase rdev reference in
md_super_write() to avoid the race.
Reported-and-tested-by: Xiao Ni <xni@redhat.com>
Reviewed-by: Neil Brown <neilb@suse.de>
Signed-off-by: Shaohua Li <shli@fb.com>
2016-03-31 10:04:18 -07:00
2016-03-24 22:59:58 -07:00
2016-03-18 20:06:46 -07:00
2016-03-17 21:38:27 -07:00
2016-03-24 22:59:58 -07:00
2016-03-26 15:53:16 -07:00
2016-03-21 13:14:16 -07:00
2016-03-25 09:02:13 -07:00
2016-03-23 06:06:45 -07:00
2016-03-24 10:32:42 -07:00
2016-03-24 22:59:58 -07:00
2016-03-21 15:50:28 +01:00
2016-03-23 06:12:39 -07:00
2016-03-17 02:30:16 +01:00
2016-03-24 23:13:48 -07:00
2016-03-21 09:26:45 +01:00
2016-03-16 08:36:55 -07:00
2016-03-25 08:52:25 -07:00
2016-03-22 15:36:02 -07:00
2016-03-30 10:39:39 +02:00
2016-03-25 08:48:31 -07:00
2016-03-22 15:36:02 -07:00
2016-03-17 13:47:50 -07:00
2016-03-27 10:37:48 -07:00
2016-03-22 12:47:40 -07:00
2016-03-20 16:59:27 -04:00
2016-03-23 16:19:38 -04:00
2016-03-18 10:15:11 -07:00
2016-03-23 15:57:39 -07:00
2016-03-25 16:59:11 -07:00
2016-03-22 11:57:43 -07:00
2016-03-23 12:02:29 +01:00
2016-03-20 16:47:13 -04:00
2016-03-23 17:20:59 -07:00
2016-03-18 18:10:38 -07:00
2016-03-23 06:09:15 -07:00
2016-03-31 10:04:18 -07:00
2016-03-21 13:49:01 -07:00
2016-03-24 19:57:15 -07:00
2016-03-25 16:37:42 -07:00
2016-03-18 10:15:11 -07:00
2016-03-20 19:08:56 -07:00
2016-03-21 14:35:52 -07:00
2016-03-24 19:57:15 -07:00
2016-03-24 23:13:48 -07:00
2016-03-19 10:05:34 -07:00
2016-03-26 11:44:33 -04:00
2016-03-28 17:19:31 -07:00
2016-03-22 10:27:29 -06:00
2016-03-19 15:15:07 -07:00
2016-03-16 14:45:55 -07:00
2016-03-22 07:50:11 -05:00
2016-03-21 11:36:17 +00:00
2016-03-18 19:26:54 -07:00
2016-03-23 17:20:59 -07:00
2016-03-25 16:55:37 -07:00
2016-03-15 12:13:56 -07:00
2016-03-23 17:11:48 +01:00
2016-03-22 15:36:02 -07:00
2016-03-18 10:15:11 -07:00
2016-03-24 22:49:08 -07:00
2016-03-20 13:28:18 -07:00
2016-03-26 11:31:01 -07:00
2016-03-20 15:40:32 -07:00
2016-03-17 12:34:54 -07:00
2016-03-25 08:48:31 -07:00
2016-03-22 12:41:14 -07:00
2016-03-18 14:10:57 +08:00
2016-03-22 12:55:17 -07:00
2016-03-23 06:06:45 -07:00
2016-03-17 13:05:09 -07:00
2016-03-22 12:41:14 -07:00
2016-03-23 06:06:45 -07:00
2016-03-20 13:28:18 -07:00
2016-03-22 15:36:02 -07:00
2016-03-22 12:55:17 -07:00
ed3b98c71c