]>
Commit | Line | Data |
---|---|---|
d3e91060 SL |
1 | From 4713b6bf6deeea25306bddfdcc703029704e8a32 Mon Sep 17 00:00:00 2001 |
2 | From: Anders Roxell <anders.roxell@linaro.org> | |
3 | Date: Tue, 30 Oct 2018 12:35:45 +0100 | |
4 | Subject: writeback: don't decrement wb->refcnt if !wb->bdi | |
5 | ||
6 | [ Upstream commit 347a28b586802d09604a149c1a1f6de5dccbe6fa ] | |
7 | ||
8 | This happened while running in qemu-system-aarch64, the AMBA PL011 UART | |
9 | driver when enabling CONFIG_DEBUG_TEST_DRIVER_REMOVE. | |
10 | arch_initcall(pl011_init) came before subsys_initcall(default_bdi_init), | |
11 | devtmpfs' handle_remove() crashes because the reference count is a NULL | |
12 | pointer only because wb->bdi hasn't been initialized yet. | |
13 | ||
14 | Rework so that wb_put have an extra check if wb->bdi before decrement | |
15 | wb->refcnt and also add a WARN_ON_ONCE to get a warning if it happens again | |
16 | in other drivers. | |
17 | ||
18 | Fixes: 52ebea749aae ("writeback: make backing_dev_info host cgroup-specific bdi_writebacks") | |
19 | Co-developed-by: Arnd Bergmann <arnd@arndb.de> | |
20 | Signed-off-by: Arnd Bergmann <arnd@arndb.de> | |
21 | Signed-off-by: Anders Roxell <anders.roxell@linaro.org> | |
22 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
23 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
24 | --- | |
25 | include/linux/backing-dev-defs.h | 8 ++++++++ | |
26 | 1 file changed, 8 insertions(+) | |
27 | ||
28 | diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h | |
29 | index a307c37c2e6c..072501a0ac86 100644 | |
30 | --- a/include/linux/backing-dev-defs.h | |
31 | +++ b/include/linux/backing-dev-defs.h | |
32 | @@ -225,6 +225,14 @@ static inline void wb_get(struct bdi_writeback *wb) | |
33 | */ | |
34 | static inline void wb_put(struct bdi_writeback *wb) | |
35 | { | |
36 | + if (WARN_ON_ONCE(!wb->bdi)) { | |
37 | + /* | |
38 | + * A driver bug might cause a file to be removed before bdi was | |
39 | + * initialized. | |
40 | + */ | |
41 | + return; | |
42 | + } | |
43 | + | |
44 | if (wb != &wb->bdi->wb) | |
45 | percpu_ref_put(&wb->refcnt); | |
46 | } | |
47 | -- | |
48 | 2.19.1 | |
49 |