3.14-stable patches

added patches:
	md-raid5-fix-locking-in-handle_stripe_clean_event.patch

diff --git a/queue-3.14/md-raid5-fix-locking-in-handle_stripe_clean_event.patch b/queue-3.14/md-raid5-fix-locking-in-handle_stripe_clean_event.patch
new file mode 100644 (file)
index 0000000..19288d5
--- /dev/null
+++ b/queue-3.14/md-raid5-fix-locking-in-handle_stripe_clean_event.patch
@@ -0,0 +1,66 @@
+From b8a9d66d043ffac116100775a469f05f5158c16f Mon Sep 17 00:00:00 2001
+From: Roman Gushchin <klamm@yandex-team.ru>
+Date: Sat, 31 Oct 2015 10:53:50 +1100
+Subject: md/raid5: fix locking in handle_stripe_clean_event()
+
+From: Roman Gushchin <klamm@yandex-team.ru>
+
+commit b8a9d66d043ffac116100775a469f05f5158c16f upstream.
+
+After commit 566c09c53455 ("raid5: relieve lock contention in get_active_stripe()")
+__find_stripe() is called under conf->hash_locks + hash.
+But handle_stripe_clean_event() calls remove_hash() under
+conf->device_lock.
+
+Under some cirscumstances the hash chain can be circuited,
+and we get an infinite loop with disabled interrupts and locked hash
+lock in __find_stripe(). This leads to hard lockup on multiple CPUs
+and following system crash.
+
+I was able to reproduce this behavior on raid6 over 6 ssd disks.
+The devices_handle_discard_safely option should be set to enable trim
+support. The following script was used:
+
+for i in `seq 1 32`; do
+    dd if=/dev/zero of=large$i bs=10M count=100 &
+done
+
+neilb: original was against a 3.x kernel.  I forward-ported
+  to 4.3-rc.  This verison is suitable for any kernel since
+  Commit: 59fc630b8b5f ("RAID5: batch adjacent full stripe write")
+  (v4.1+).  I'll post a version for earlier kernels to stable.
+
+Signed-off-by: Roman Gushchin <klamm@yandex-team.ru>
+Fixes: 566c09c53455 ("raid5: relieve lock contention in get_active_stripe()")
+Signed-off-by: NeilBrown <neilb@suse.com>
+Cc: Shaohua Li <shli@kernel.org>
+Cc: <stable@vger.kernel.org> # 3.13 - 4.2
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid5.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3029,6 +3029,8 @@ static void handle_stripe_clean_event(st
+               }
+       if (!discard_pending &&
+           test_bit(R5_Discard, &sh->dev[sh->pd_idx].flags)) {
++              int hash = sh->hash_lock_index;
++
+               clear_bit(R5_Discard, &sh->dev[sh->pd_idx].flags);
+               clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags);
+               if (sh->qd_idx >= 0) {
+@@ -3042,9 +3044,9 @@ static void handle_stripe_clean_event(st
+                * no updated data, so remove it from hash list and the stripe
+                * will be reinitialized
+                */
+-              spin_lock_irq(&conf->device_lock);
++              spin_lock_irq(conf->hash_locks + hash);
+               remove_hash(sh);
+-              spin_unlock_irq(&conf->device_lock);
++              spin_unlock_irq(conf->hash_locks + hash);
+               if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state))
+                       set_bit(STRIPE_HANDLE, &sh->state);
+ 

diff --git a/queue-3.14/series b/queue-3.14/series
index 299012b168d60e9251c5f77e87873d9bac9d440a..d34e03ccc74eca32ab41e024ea8cbd4a51fb75c3 100644 (file)
--- a/queue-3.14/series
+++ b/queue-3.14/series
@@ -31,3 +31,4 @@ md-raid10-submit_bio_wait-returns-0-on-success.patch
 revert-md-allow-a-partially-recovered-device-to-be-hot-added-to-an-array.patch
 mvsas-fix-null-pointer-dereference-in-mvs_slot_task_free.patch
 ib-cm-fix-rb-tree-duplicate-free-and-use-after-free.patch
+md-raid5-fix-locking-in-handle_stripe_clean_event.patch