| 1 |
From fbd57818b1e3d67906c08a2c6a70a3e0233c7311 Mon Sep 17 00:00:00 2001 |
| 2 |
From: Jia-Ju Bai <baijiaju1990@gmail.com> |
| 3 |
Date: Tue, 9 Oct 2018 13:12:00 +0200 |
| 4 |
Subject: [PATCH 015/145] lightnvm: pblk: fix two sleep-in-atomic-context bugs |
| 5 |
MIME-Version: 1.0 |
| 6 |
Content-Type: text/plain; charset=UTF-8 |
| 7 |
Content-Transfer-Encoding: 8bit |
| 8 |
|
| 9 |
[ Upstream commit 7325b4bbe5952e3e939f15de812f2ee0c0d33ca9 ] |
| 10 |
|
| 11 |
The driver may sleep with holding a spinlock. |
| 12 |
|
| 13 |
The function call paths (from bottom to top) in Linux-4.16 are: |
| 14 |
|
| 15 |
[FUNC] nvm_dev_dma_alloc(GFP_KERNEL) |
| 16 |
drivers/lightnvm/pblk-core.c, 754: |
| 17 |
nvm_dev_dma_alloc in pblk_line_submit_smeta_io |
| 18 |
drivers/lightnvm/pblk-core.c, 1048: |
| 19 |
pblk_line_submit_smeta_io in pblk_line_init_bb |
| 20 |
drivers/lightnvm/pblk-core.c, 1434: |
| 21 |
pblk_line_init_bb in pblk_line_replace_data |
| 22 |
drivers/lightnvm/pblk-recovery.c, 980: |
| 23 |
pblk_line_replace_data in pblk_recov_l2p |
| 24 |
drivers/lightnvm/pblk-recovery.c, 976: |
| 25 |
spin_lock in pblk_recov_l2p |
| 26 |
|
| 27 |
[FUNC] bio_map_kern(GFP_KERNEL) |
| 28 |
drivers/lightnvm/pblk-core.c, 762: |
| 29 |
bio_map_kern in pblk_line_submit_smeta_io |
| 30 |
drivers/lightnvm/pblk-core.c, 1048: |
| 31 |
pblk_line_submit_smeta_io in pblk_line_init_bb |
| 32 |
drivers/lightnvm/pblk-core.c, 1434: |
| 33 |
pblk_line_init_bb in pblk_line_replace_data |
| 34 |
drivers/lightnvm/pblk-recovery.c, 980: |
| 35 |
pblk_line_replace_data in pblk_recov_l2p |
| 36 |
drivers/lightnvm/pblk-recovery.c, 976: |
| 37 |
spin_lock in pblk_recov_l2p |
| 38 |
|
| 39 |
To fix these bugs, the call to pblk_line_replace_data() |
| 40 |
is moved out of the spinlock protection. |
| 41 |
|
| 42 |
These bugs are found by my static analysis tool DSAC. |
| 43 |
|
| 44 |
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> |
| 45 |
Reviewed-by: Javier González <javier@cnexlabs.com> |
| 46 |
Signed-off-by: Matias Bjørling <mb@lightnvm.io> |
| 47 |
Signed-off-by: Jens Axboe <axboe@kernel.dk> |
| 48 |
Signed-off-by: Sasha Levin <sashal@kernel.org> |
| 49 |
--- |
| 50 |
drivers/lightnvm/pblk-recovery.c | 6 ++++-- |
| 51 |
1 file changed, 4 insertions(+), 2 deletions(-) |
| 52 |
|
| 53 |
diff --git a/drivers/lightnvm/pblk-recovery.c b/drivers/lightnvm/pblk-recovery.c |
| 54 |
index e232e47e1353..df75d9caec45 100644 |
| 55 |
--- a/drivers/lightnvm/pblk-recovery.c |
| 56 |
+++ b/drivers/lightnvm/pblk-recovery.c |
| 57 |
@@ -956,12 +956,14 @@ struct pblk_line *pblk_recov_l2p(struct pblk *pblk) |
| 58 |
} |
| 59 |
} |
| 60 |
|
| 61 |
- spin_lock(&l_mg->free_lock); |
| 62 |
if (!open_lines) { |
| 63 |
+ spin_lock(&l_mg->free_lock); |
| 64 |
WARN_ON_ONCE(!test_and_clear_bit(meta_line, |
| 65 |
&l_mg->meta_bitmap)); |
| 66 |
+ spin_unlock(&l_mg->free_lock); |
| 67 |
pblk_line_replace_data(pblk); |
| 68 |
} else { |
| 69 |
+ spin_lock(&l_mg->free_lock); |
| 70 |
/* Allocate next line for preparation */ |
| 71 |
l_mg->data_next = pblk_line_get(pblk); |
| 72 |
if (l_mg->data_next) { |
| 73 |
@@ -969,8 +971,8 @@ struct pblk_line *pblk_recov_l2p(struct pblk *pblk) |
| 74 |
l_mg->data_next->type = PBLK_LINETYPE_DATA; |
| 75 |
is_next = 1; |
| 76 |
} |
| 77 |
+ spin_unlock(&l_mg->free_lock); |
| 78 |
} |
| 79 |
- spin_unlock(&l_mg->free_lock); |
| 80 |
|
| 81 |
if (is_next) |
| 82 |
pblk_line_erase(pblk, l_mg->data_next); |
| 83 |
-- |
| 84 |
2.19.1 |
| 85 |
|
Parent Directory
| 
Revision Log