From: Niranjan Dighe <[email protected]> Following kernel crash was observed because of a possible race condition in block layer that passes struct percpu_counter *fcp with fcp->counters field NULL. Added extra checks to prevent similar crashes because of bugs in the upper layers.
This is fairly easy to reproduce with kernel 4.1.15+ when a USB device is mounted on multiple mount points with a -B (bind) option and multiple connection/disconnections are made repeatedly. --- Unable to handle kernel paging request at virtual address 2ac60000 pgd = a2918000 [2ac60000] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM Modules linked in: vfat fat sd_mod ntfs usb_storage scsi_mod usbhid hid snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi fuse sd8xxx(O) mlan(PO) mmc_block spidev sdhci_esdhc_imx sdhci_pltfm sdhci spi_imx spi_bitbang ext4 jbd2 ipv6 CPU: 0 PID: 319 Comm: usbmgr Tainted: P W O 4.1.15-1.2.0+g77f6154 #2 Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) task: a23b7c00 ti: a843c000 task.ti: a843c000 PC is at __percpu_counter_add+0x34/0xf8 LR is at clear_page_dirty_for_io+0xc4/0xe0 pc : [<80213708>] lr : [<80098810>] psr: 200f0093 sp : a843de00 ip : a843de00 fp : abb6a0a0 r10: a843def8 r9 : 0000019b r8 : a6020b64 r7 : 00000000 r6 : 00000002 r5 : ffffffff r4 : ffffffff r3 : 00000000 r2 : 00000010 r1 : 2ac60000 r0 : a8334920 Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user Control: 10c53c7d Table: 3291804a DAC: 00000015 Process usbmgr (pid: 319, stack limit = 0xa843c210) Stack: (0xa843de00 to 0xa843e000) de00: 200f0013 a6020b64 00000002 ffffffff a6020b64 0000019b a843def8 80098810 de20: 00000010 8009ab24 a843de70 00000000 a843de70 8009896c 0000000e 00000000 de40: 00000000 00000000 800982dc a6020b64 00000002 00000001 00000001 a81b5e20 de60: a00f0193 000008e3 00000002 00000000 abb6a0a0 abc1b7c0 758045a0 80054b74 de80: 0000406f 8027ce94 a81b5c10 5355843b 00000000 00000001 00000001 00004000 dea0: 00000125 a81843c0 80ba11a8 a6020b64 a843def8 ffffffff 7fffffff 00000000 dec0: 00000000 00000000 758045a0 80098be8 a843ded0 a843ded0 a843ded8 a843ded8 dee0: a843dee0 a843dee0 a6020b64 a6020b64 00000001 8009064c 7fffffff 00000000 df00: 00000000 00000000 ffffffff 7fffffff 00000001 00000000 8000f684 a6020b64 df20: 00000081 ffffffff 7fffffff 8000f684 a843c000 800906ec ffffffff 7fffffff df40: 00000001 a23b7c00 8000f684 a6020a00 00000081 80ba2ca4 a23b7c00 800cdf5c df60: a3090c00 7f343ea4 80ba2ca4 800ce224 a2b06840 00000000 80ba2ca4 800e7aec df80: a23b7f78 8003e124 a843c000 8000f684 a843dfb0 00000034 8000f684 80012000 dfa0: 758045a8 00000018 00000001 8000f54c 00000000 00000002 00000001 76f0dcfc dfc0: 758045a8 00000018 00000001 00000034 aaaaaaab 00083d48 758045a0 758045a0 dfe0: 0009945c 7696dc0c 0006c31c 76b175bc 60010010 758045a8 00000000 00000000 [<80213708>] (__percpu_counter_add) from [<80098810>] (clear_page_dirty_for_io+0xc4/0xe0) [<80098810>] (clear_page_dirty_for_io) from [<8009896c>] (write_cache_pages+0x140/0x37c) [<8009896c>] (write_cache_pages) from [<80098be8>] (generic_writepages+0x40/0x60) [<80098be8>] (generic_writepages) from [<8009064c>] (__filemap_fdatawrite_range+0x64/0x6c) [<8009064c>] (__filemap_fdatawrite_range) from [<800906ec>] (filemap_write_and_wait+0x38/0x64) [<800906ec>] (filemap_write_and_wait) from [<800cdf5c>] (kill_block_super+0x20/0x68) [<800cdf5c>] (kill_block_super) from [<800ce224>] (deactivate_locked_super+0x58/0x7c) [<800ce224>] (deactivate_locked_super) from [<800e7aec>] (cleanup_mnt+0x38/0x7c) [<800e7aec>] (cleanup_mnt) from [<8003e124>] (task_work_run+0xac/0xe4) [<8003e124>] (task_work_run) from [<80012000>] (do_work_pending+0x7c/0xa4) [<80012000>] (do_work_pending) from [<8000f54c>] (work_pending+0xc/0x20) Code: e5813004 e5903018 e1a07fc2 ee1d1f90 (e7933001) ---[ end trace 4b693779c2eb6edd ]--- Signed-off-by: Niranjan Dighe <[email protected]> --- lib/percpu_counter.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lib/percpu_counter.c b/lib/percpu_counter.c index f051d69..4e8c163 100644 --- a/lib/percpu_counter.c +++ b/lib/percpu_counter.c @@ -77,6 +77,10 @@ void __percpu_counter_add(struct percpu_counter *fbc, s64 amount, s32 batch) s64 count; preempt_disable(); + + if (unlikely(!fbc->counters)) + goto out; + count = __this_cpu_read(*fbc->counters) + amount; if (count >= batch || count <= -batch) { unsigned long flags; @@ -87,6 +91,7 @@ void __percpu_counter_add(struct percpu_counter *fbc, s64 amount, s32 batch) } else { this_cpu_add(*fbc->counters, amount); } +out: preempt_enable(); } EXPORT_SYMBOL(__percpu_counter_add); -- 2.1.4
