4.9-stable patches

added patches:
	xfs-clear-pf_memalloc-before-exiting-xfsaild-thread.patch

diff --git a/queue-4.9/series b/queue-4.9/series
index e6e975762c035f2715c5b18d2547dcf2d6c85f52..1b656a3f2e74d7b61e38cbe1a421e55074c5c080 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -63,3 +63,4 @@ usb-gadget-udc-bdc-remove-unnecessary-null-checks-in-bdc_req_complete.patch
 nfsd-memory-corruption-in-nfsd4_lock.patch
 net-cxgb4-check-the-return-from-t4_query_params-properly.patch
 perf-core-fix-parent-pid-tid-in-task-exit-events.patch
+xfs-clear-pf_memalloc-before-exiting-xfsaild-thread.patch

diff --git a/queue-4.9/xfs-clear-pf_memalloc-before-exiting-xfsaild-thread.patch b/queue-4.9/xfs-clear-pf_memalloc-before-exiting-xfsaild-thread.patch
new file mode 100644 (file)
index 0000000..25b4255
--- /dev/null
+++ b/queue-4.9/xfs-clear-pf_memalloc-before-exiting-xfsaild-thread.patch
@@ -0,0 +1,98 @@
+From 10a98cb16d80be3595fdb165fad898bb28b8b6d2 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Tue, 10 Mar 2020 08:57:27 -0700
+Subject: xfs: clear PF_MEMALLOC before exiting xfsaild thread
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 10a98cb16d80be3595fdb165fad898bb28b8b6d2 upstream.
+
+Leaving PF_MEMALLOC set when exiting a kthread causes it to remain set
+during do_exit().  That can confuse things.  In particular, if BSD
+process accounting is enabled, then do_exit() writes data to an
+accounting file.  If that file has FS_SYNC_FL set, then this write
+occurs synchronously and can misbehave if PF_MEMALLOC is set.
+
+For example, if the accounting file is located on an XFS filesystem,
+then a WARN_ON_ONCE() in iomap_do_writepage() is triggered and the data
+doesn't get written when it should.  Or if the accounting file is
+located on an ext4 filesystem without a journal, then a WARN_ON_ONCE()
+in ext4_write_inode() is triggered and the inode doesn't get written.
+
+Fix this in xfsaild() by using the helper functions to save and restore
+PF_MEMALLOC.
+
+This can be reproduced as follows in the kvm-xfstests test appliance
+modified to add the 'acct' Debian package, and with kvm-xfstests's
+recommended kconfig modified to add CONFIG_BSD_PROCESS_ACCT=y:
+
+        mkfs.xfs -f /dev/vdb
+        mount /vdb
+        touch /vdb/file
+        chattr +S /vdb/file
+        accton /vdb/file
+        mkfs.xfs -f /dev/vdc
+        mount /vdc
+        umount /vdc
+
+It causes:
+       WARNING: CPU: 1 PID: 336 at fs/iomap/buffered-io.c:1534
+       CPU: 1 PID: 336 Comm: xfsaild/vdc Not tainted 5.6.0-rc5 #3
+       Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014
+       RIP: 0010:iomap_do_writepage+0x16b/0x1f0 fs/iomap/buffered-io.c:1534
+       [...]
+       Call Trace:
+        write_cache_pages+0x189/0x4d0 mm/page-writeback.c:2238
+        iomap_writepages+0x1c/0x33 fs/iomap/buffered-io.c:1642
+        xfs_vm_writepages+0x65/0x90 fs/xfs/xfs_aops.c:578
+        do_writepages+0x41/0xe0 mm/page-writeback.c:2344
+        __filemap_fdatawrite_range+0xd2/0x120 mm/filemap.c:421
+        file_write_and_wait_range+0x71/0xc0 mm/filemap.c:760
+        xfs_file_fsync+0x7a/0x2b0 fs/xfs/xfs_file.c:114
+        generic_write_sync include/linux/fs.h:2867 [inline]
+        xfs_file_buffered_aio_write+0x379/0x3b0 fs/xfs/xfs_file.c:691
+        call_write_iter include/linux/fs.h:1901 [inline]
+        new_sync_write+0x130/0x1d0 fs/read_write.c:483
+        __kernel_write+0x54/0xe0 fs/read_write.c:515
+        do_acct_process+0x122/0x170 kernel/acct.c:522
+        slow_acct_process kernel/acct.c:581 [inline]
+        acct_process+0x1d4/0x27c kernel/acct.c:607
+        do_exit+0x83d/0xbc0 kernel/exit.c:791
+        kthread+0xf1/0x140 kernel/kthread.c:257
+        ret_from_fork+0x27/0x50 arch/x86/entry/entry_64.S:352
+
+This bug was originally reported by syzbot at
+https://lore.kernel.org/r/0000000000000e7156059f751d7b@google.com.
+
+Reported-by: syzbot+1f9dc49e8de2582d90c2@syzkaller.appspotmail.com
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_trans_ail.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/xfs/xfs_trans_ail.c
++++ b/fs/xfs/xfs_trans_ail.c
+@@ -495,8 +495,9 @@ xfsaild(
+ {
+       struct xfs_ail  *ailp = data;
+       long            tout = 0;       /* milliseconds */
++      unsigned int    noreclaim_flag;
+ 
+-      current->flags |= PF_MEMALLOC;
++      noreclaim_flag = memalloc_noreclaim_save();
+       set_freezable();
+ 
+       while (!kthread_should_stop()) {
+@@ -536,6 +537,7 @@ xfsaild(
+               tout = xfsaild_push(ailp);
+       }
+ 
++      memalloc_noreclaim_restore(noreclaim_flag);
+       return 0;
+ }
+