[PATCH] block: use rcu_work instead of call_rcu to avoid sleep in softirq

[Yufen Yu]

We recently got a stack by syzkaller like this:

BUG: sleeping function called from invalid context at mm/slab.h:361
in_atomic(): 1, irqs_disabled(): 0, pid: 6644, name: blkid
INFO: lockdep is turned off.
CPU: 1 PID: 6644 Comm: blkid Not tainted 4.4.163-514.55.6.9.x86_64+ #76
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 
04/01/2014
  5ba6a6b879e50c00 8801f6b07b10 81cb2194
 41b58ab3 833c7745 81cb2080 5ba6a6b879e50c00
  0001 0004 
Call Trace:
   [] __dump_stack lib/dump_stack.c:15 [inline]
   [] dump_stack+0x114/0x1a0 lib/dump_stack.c:51
 [] ___might_sleep+0x291/0x490 kernel/sched/core.c:7675
 [] __might_sleep+0xb3/0x270 kernel/sched/core.c:7637
 [] slab_pre_alloc_hook mm/slab.h:361 [inline]
 [] slab_alloc_node mm/slub.c:2610 [inline]
 [] slab_alloc mm/slub.c:2692 [inline]
 [] kmem_cache_alloc_trace+0x2c3/0x5c0 mm/slub.c:2709
 [] kmalloc include/linux/slab.h:479 [inline]
 [] kzalloc include/linux/slab.h:623 [inline]
 [] kobject_uevent_env+0x2c7/0x1150 lib/kobject_uevent.c:227
 [] kobject_uevent+0x1f/0x30 lib/kobject_uevent.c:374
 [] kobject_cleanup lib/kobject.c:633 [inline]
 [] kobject_release+0x229/0x440 lib/kobject.c:675
 [] kref_sub include/linux/kref.h:73 [inline]
 [] kref_put include/linux/kref.h:98 [inline]
 [] kobject_put+0x72/0xd0 lib/kobject.c:692
 [] put_device+0x25/0x30 drivers/base/core.c:1237
 [] delete_partition_rcu_cb+0x1d4/0x2f0 
block/partition-generic.c:232
 [] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
 [] rcu_do_batch kernel/rcu/tree.c:2705 [inline]
 [] invoke_rcu_callbacks kernel/rcu/tree.c:2973 [inline]
 [] __rcu_process_callbacks kernel/rcu/tree.c:2940 [inline]
 [] rcu_process_callbacks+0x59c/0x1c70 kernel/rcu/tree.c:2957
 [] __do_softirq+0x299/0xe20 kernel/softirq.c:273
 [] invoke_softirq kernel/softirq.c:350 [inline]
 [] irq_exit+0x216/0x2c0 kernel/softirq.c:391
 [] exiting_irq arch/x86/include/asm/apic.h:652 [inline]
 [] smp_apic_timer_interrupt+0x8b/0xc0 
arch/x86/kernel/apic/apic.c:926
 [] apic_timer_interrupt+0xa5/0xb0 
arch/x86/entry/entry_64.S:746
   [] ? audit_kill_trees+0x180/0x180
 [] fd_install+0x57/0x80 fs/file.c:626
 [] do_sys_open+0x45e/0x550 fs/open.c:1043
 [] SYSC_open fs/open.c:1055 [inline]
 [] SyS_open+0x32/0x40 fs/open.c:1050
 [] entry_SYSCALL_64_fastpath+0x1e/0x9a

In softirq context, we call rcu callback function delete_partition_rcu_cb(),
which may allocate memory by kzalloc with GFP_KERNEL flag. If the
allocation cannot be satisfied, it may sleep. However, That is not allowed
in softirq contex.

Although we found this problem on linux 4.4, the latest kernel version
seems to have this problem as well. And it is very similar to the
previous one:
https://lkml.org/lkml/2018/7/9/391

Fix it by using RCU workqueue, which allows sleep.

Signed-off-by: Yufen Yu 
---
 block/partition-generic.c | 8 +---
 include/linux/genhd.h | 2 +-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/block/partition-generic.c b/block/partition-generic.c
index d3d14e81fb12..5f8db5c5140f 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -249,9 +249,10 @@ struct device_type part_type = {
.uevent = part_uevent,
 };
 
-static void delete_partition_rcu_cb(struct rcu_head *head)
+static void delete_partition_work_fn(struct work_struct *work)
 {
-   struct hd_struct *part = container_of(head, struct hd_struct, rcu_head);
+   struct hd_struct *part = container_of(to_rcu_work(work), struct 
hd_struct,
+   rcu_work);
 
part->start_sect = 0;
part->nr_sects = 0;
@@ -262,7 +263,8 @@ static void delete_partition_rcu_cb(struct rcu_head *head)
 void __delete_partition(struct percpu_ref *ref)
 {
struct hd_struct *part = container_of(ref, struct hd_struct, ref);
-   call_rcu(>rcu_head, delete_partition_rcu_cb);
+   INIT_RCU_WORK(>rcu_work, delete_partition_work_fn);
+   queue_rcu_work(system_wq, >rcu_work);
 }
 
 /*
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index 70fc838e6773..0c5ee17b4d88 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -129,7 +129,7 @@ struct hd_struct {
struct disk_stats dkstats;
 #endif
struct percpu_ref ref;
-   struct rcu_head rcu_head;
+   struct rcu_work rcu_work;
 };
 
 #define GENHD_FL_REMOVABLE 1
-- 
2.16.2.dirty

[PATCH blktests] fix discontiguous-io compile error on 32 bit systems

[Yufen Yu]

When make discontiguous-io.cpp with -m32, g++ compiler reports
error for std::min(long unsigned int, size_t) has diffent
arguments type.

fixes: fd21728886e7 ("Add the discontiguous-io test program")
Signed-off-by: Yufen Yu 
---
 src/discontiguous-io.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/discontiguous-io.cpp b/src/discontiguous-io.cpp
index 5e0ee0f..855aba9 100644
--- a/src/discontiguous-io.cpp
+++ b/src/discontiguous-io.cpp
@@ -291,7 +291,7 @@ int main(int argc, char **argv)
unsigned char *p = &*buf.begin();
for (int i = 0; i < len / 4; i++)
iov.append(p + 4 + i * 8,
-  std::min(4ul, len - i * 4));
+  std::min((size_t)4, len - i * 4));
} else {
iov.append(&*buf.begin(), buf.size());
}
-- 
2.7.4