Revision 6f1b228529ae49b0f85ab89bcdb6c365df401558 authored by Gautham Ananthakrishna on 28 October 2021, 21:36:17 UTC, committed by Linus Torvalds on 29 October 2021, 00:18:55 UTC
Encountered a race between ocfs2_test_bg_bit_allocatable() and
jbd2_journal_put_journal_head() resulting in the below vmcore.

  PID: 106879  TASK: ffff880244ba9c00  CPU: 2   COMMAND: "loop3"
  Call trace:
    panic
    oops_end
    no_context
    __bad_area_nosemaphore
    bad_area_nosemaphore
    __do_page_fault
    do_page_fault
    page_fault
      [exception RIP: ocfs2_block_group_find_clear_bits+316]
    ocfs2_block_group_find_clear_bits [ocfs2]
    ocfs2_cluster_group_search [ocfs2]
    ocfs2_search_chain [ocfs2]
    ocfs2_claim_suballoc_bits [ocfs2]
    __ocfs2_claim_clusters [ocfs2]
    ocfs2_claim_clusters [ocfs2]
    ocfs2_local_alloc_slide_window [ocfs2]
    ocfs2_reserve_local_alloc_bits [ocfs2]
    ocfs2_reserve_clusters_with_limit [ocfs2]
    ocfs2_reserve_clusters [ocfs2]
    ocfs2_lock_refcount_allocators [ocfs2]
    ocfs2_make_clusters_writable [ocfs2]
    ocfs2_replace_cow [ocfs2]
    ocfs2_refcount_cow [ocfs2]
    ocfs2_file_write_iter [ocfs2]
    lo_rw_aio
    loop_queue_work
    kthread_worker_fn
    kthread
    ret_from_fork

When ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the
bg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and
released the jounal head from the buffer head.  Needed to take bit lock
for the bit 'BH_JournalHead' to fix this race.

Link: https://lkml.kernel.org/r/1634820718-6043-1-git-send-email-gautham.ananthakrishna@oracle.com
Signed-off-by: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: <rajesh.sivaramasubramaniom@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 337546e
History
File Mode Size
index.rst -rw-r--r-- 367 bytes
leds-blinkm.rst -rw-r--r-- 2.0 KB
leds-class-flash.rst -rw-r--r-- 3.2 KB
leds-class-multicolor.rst -rw-r--r-- 3.0 KB
leds-class.rst -rw-r--r-- 7.2 KB
leds-el15203000.rst -rw-r--r-- 4.3 KB
leds-lm3556.rst -rw-r--r-- 3.0 KB
leds-lp3944.rst -rw-r--r-- 1.5 KB
leds-lp5521.rst -rw-r--r-- 2.9 KB
leds-lp5523.rst -rw-r--r-- 3.4 KB
leds-lp5562.rst -rw-r--r-- 3.6 KB
leds-lp55xx.rst -rw-r--r-- 6.7 KB
leds-mlxcpld.rst -rw-r--r-- 2.4 KB
leds-sc27xx.rst -rw-r--r-- 989 bytes
ledtrig-oneshot.rst -rw-r--r-- 1.5 KB
ledtrig-transient.rst -rw-r--r-- 6.9 KB
ledtrig-usbport.rst -rw-r--r-- 1.4 KB
uleds.rst -rw-r--r-- 1.2 KB
well-known-leds.txt -rw-r--r-- 1.6 KB

back to top