releases/4.4.181/fs-writeback.c-use-rcu_barrier-to-wait-for-inflight-wb-switches-going-into-workqueue-when-umount.patch

   1 From ec084de929e419e51bcdafaafe567d9e7d0273b7 Mon Sep 17 00:00:00 2001
   2 From: Jiufei Xue <jiufei.xue@linux.alibaba.com>
   3 Date: Fri, 17 May 2019 14:31:44 -0700
   4 Subject: fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount
   5
   6 From: Jiufei Xue <jiufei.xue@linux.alibaba.com>
   7
   8 commit ec084de929e419e51bcdafaafe567d9e7d0273b7 upstream.
   9
  10 synchronize_rcu() didn't wait for call_rcu() callbacks, so inode wb
  11 switch may not go to the workqueue after synchronize_rcu().  Thus
  12 previous scheduled switches was not finished even flushing the
  13 workqueue, which will cause a NULL pointer dereferenced followed below.
  14
  15   VFS: Busy inodes after unmount of vdd. Self-destruct in 5 seconds.  Have a nice day...
  16   BUG: unable to handle kernel NULL pointer dereference at 0000000000000278
  17     evict+0xb3/0x180
  18     iput+0x1b0/0x230
  19     inode_switch_wbs_work_fn+0x3c0/0x6a0
  20     worker_thread+0x4e/0x490
  21     ? process_one_work+0x410/0x410
  22     kthread+0xe6/0x100
  23     ret_from_fork+0x39/0x50
  24
  25 Replace the synchronize_rcu() call with a rcu_barrier() to wait for all
  26 pending callbacks to finish.  And inc isw_nr_in_flight after call_rcu()
  27 in inode_switch_wbs() to make more sense.
  28
  29 Link: http://lkml.kernel.org/r/20190429024108.54150-1-jiufei.xue@linux.alibaba.com
  30 Signed-off-by: Jiufei Xue <jiufei.xue@linux.alibaba.com>
  31 Acked-by: Tejun Heo <tj@kernel.org>
  32 Suggested-by: Tejun Heo <tj@kernel.org>
  33 Cc: <stable@vger.kernel.org>
  34 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  35 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  36 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  37
  38 ---
  39  fs/fs-writeback.c |   11 ++++++++---
  40  1 file changed, 8 insertions(+), 3 deletions(-)
  41
  42 --- a/fs/fs-writeback.c
  43 +++ b/fs/fs-writeback.c
  44 @@ -530,8 +530,6 @@ static void inode_switch_wbs(struct inod
  45         ihold(inode);
  46         isw->inode = inode;
  47
  48 -       atomic_inc(&isw_nr_in_flight);
  49 -
  50         /*
  51          * In addition to synchronizing among switchers, I_WB_SWITCH tells
  52          * the RCU protected stat update paths to grab the mapping's
  53 @@ -539,6 +537,9 @@ static void inode_switch_wbs(struct inod
  54          * Let's continue after I_WB_SWITCH is guaranteed to be visible.
  55          */
  56         call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn);
  57 +
  58 +       atomic_inc(&isw_nr_in_flight);
  59 +
  60         goto out_unlock;
  61
  62  out_free:
  63 @@ -910,7 +911,11 @@ restart:
  64  void cgroup_writeback_umount(void)
  65  {
  66         if (atomic_read(&isw_nr_in_flight)) {
  67 -               synchronize_rcu();
  68 +               /*
  69 +                * Use rcu_barrier() to wait for all pending callbacks to
  70 +                * ensure that all in-flight wb switches are in the workqueue.
  71 +                */
  72 +               rcu_barrier();
  73                 flush_workqueue(isw_wq);
  74         }
  75  }