From 4eb509b889ac6e8b70e4bac1a1f799c7688ec268 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 6 Nov 2015 09:17:54 -0800 Subject: [PATCH] 3.14-stable patches added patches: md-raid5-fix-locking-in-handle_stripe_clean_event.patch --- ...locking-in-handle_stripe_clean_event.patch | 66 +++++++++++++++++++ queue-3.14/series | 1 + 2 files changed, 67 insertions(+) create mode 100644 queue-3.14/md-raid5-fix-locking-in-handle_stripe_clean_event.patch diff --git a/queue-3.14/md-raid5-fix-locking-in-handle_stripe_clean_event.patch b/queue-3.14/md-raid5-fix-locking-in-handle_stripe_clean_event.patch new file mode 100644 index 00000000000..19288d5a875 --- /dev/null +++ b/queue-3.14/md-raid5-fix-locking-in-handle_stripe_clean_event.patch @@ -0,0 +1,66 @@ +From b8a9d66d043ffac116100775a469f05f5158c16f Mon Sep 17 00:00:00 2001 +From: Roman Gushchin +Date: Sat, 31 Oct 2015 10:53:50 +1100 +Subject: md/raid5: fix locking in handle_stripe_clean_event() + +From: Roman Gushchin + +commit b8a9d66d043ffac116100775a469f05f5158c16f upstream. + +After commit 566c09c53455 ("raid5: relieve lock contention in get_active_stripe()") +__find_stripe() is called under conf->hash_locks + hash. +But handle_stripe_clean_event() calls remove_hash() under +conf->device_lock. + +Under some cirscumstances the hash chain can be circuited, +and we get an infinite loop with disabled interrupts and locked hash +lock in __find_stripe(). This leads to hard lockup on multiple CPUs +and following system crash. + +I was able to reproduce this behavior on raid6 over 6 ssd disks. +The devices_handle_discard_safely option should be set to enable trim +support. The following script was used: + +for i in `seq 1 32`; do + dd if=/dev/zero of=large$i bs=10M count=100 & +done + +neilb: original was against a 3.x kernel. I forward-ported + to 4.3-rc. This verison is suitable for any kernel since + Commit: 59fc630b8b5f ("RAID5: batch adjacent full stripe write") + (v4.1+). I'll post a version for earlier kernels to stable. + +Signed-off-by: Roman Gushchin +Fixes: 566c09c53455 ("raid5: relieve lock contention in get_active_stripe()") +Signed-off-by: NeilBrown +Cc: Shaohua Li +Cc: # 3.13 - 4.2 +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid5.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -3029,6 +3029,8 @@ static void handle_stripe_clean_event(st + } + if (!discard_pending && + test_bit(R5_Discard, &sh->dev[sh->pd_idx].flags)) { ++ int hash = sh->hash_lock_index; ++ + clear_bit(R5_Discard, &sh->dev[sh->pd_idx].flags); + clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags); + if (sh->qd_idx >= 0) { +@@ -3042,9 +3044,9 @@ static void handle_stripe_clean_event(st + * no updated data, so remove it from hash list and the stripe + * will be reinitialized + */ +- spin_lock_irq(&conf->device_lock); ++ spin_lock_irq(conf->hash_locks + hash); + remove_hash(sh); +- spin_unlock_irq(&conf->device_lock); ++ spin_unlock_irq(conf->hash_locks + hash); + if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state)) + set_bit(STRIPE_HANDLE, &sh->state); + diff --git a/queue-3.14/series b/queue-3.14/series index 299012b168d..d34e03ccc74 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -31,3 +31,4 @@ md-raid10-submit_bio_wait-returns-0-on-success.patch revert-md-allow-a-partially-recovered-device-to-be-hot-added-to-an-array.patch mvsas-fix-null-pointer-dereference-in-mvs_slot_task_free.patch ib-cm-fix-rb-tree-duplicate-free-and-use-after-free.patch +md-raid5-fix-locking-in-handle_stripe_clean_event.patch -- 2.47.2