Received: by 2002:a05:6a11:4021:0:0:0:0 with SMTP id ky33csp1574756pxb; Thu, 16 Sep 2021 10:12:02 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxpzsEoRXiZSvrqV3Q5MgRusJJZ+eto4bDeInF22si0S0qyQvu5fWPy9CEeRdZ1EWBUphlf X-Received: by 2002:a17:907:7752:: with SMTP id kx18mr7639350ejc.276.1631812322204; Thu, 16 Sep 2021 10:12:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1631812322; cv=none; d=google.com; s=arc-20160816; b=nviJziMlpwlzpos8hwPVWtITfYG7aLaEVcGyuB6wN7PvcvmBN2g5uBPgoeYj5beIpl 9GXEHQXUs5ycIIb8pyR3F4Ltmgsv9Pqlxd02MCmhEDn7d6kuk1JMnJCZotsUSWtJgb3/ O1CTSq5lDa4kNBsdrnwzDp3cgp+1c25wWbePX2G9N33GhJq11rLxsdCwsuqy+JnXE7T1 6MM2v0eFW9bPb/j4ogR89PTGfd/km3k9yLmeSjCnf6RQrQND31RwOTS30gJXQHvWRnYF xMfoIylsHJ1I9U9x4VkIwAuXbU+xZj2KJBik6GvpFzoshZuD39BhEmPZ/5lVXbD6YQu1 fWZw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=5BqW4T5D2tyP2oBoag/HGxYUZ1nmmT7hEtFGOxObWYk=; b=rF8cm4jydtO+3Ej5HEl29HOcBt4Lr6E+0YTgAjPwuw3tJ4OsSKGRG9E4c1uVTktBwf vRTdNmP41hVOgwc0+J+dBuF7xZVhqNN2kwxPmzt7htinF4mzh48QCsOMWVFo/bf9B4KO /iqOsL5Nrpg3+mAems+lIap1mqW5pLap5mUow25zo8oP6KQKI9lO4l6drd96+qnBFZJj 3EGKwu6XVjBi3+kZ5vmAgawgWw3Q1uKOKKwBKGPbGvG1dnf5ZBHegJaNJ2mSsWgZGQ7k MHlpjRuGs8SvsKiJxFw7PXYLUMT88c2bZw5h/Bwiwq5BBwhGHBNwA1F876WQ4yfS1Dmd 5/4Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=AOKHr2JC; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id t10si4106531edv.312.2021.09.16.10.11.15; Thu, 16 Sep 2021 10:12:02 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=AOKHr2JC; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345899AbhIPRHs (ORCPT + 99 others); Thu, 16 Sep 2021 13:07:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:34164 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348211AbhIPRCQ (ORCPT ); Thu, 16 Sep 2021 13:02:16 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 73BC861AFF; Thu, 16 Sep 2021 16:33:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1631810003; bh=62okn562g9fz7aSO/nIT4SP19FQ7BSiz1dymBpvUuTI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AOKHr2JCNJ+fL4MTHqmRSCTxpiYdDI08LlCBJHqjv1k+nnrpmbdby8kXeRK5/1+i4 nppUMX4OCtk9spHOGfp+ZaKbFEgyxjeRjPWRyxHOvgUycxGpxzAOok+5qIZ1rxcAPl rka2ftWwMq9AkAWyK68J4BuCVvQG0JlEyGROiLP8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, sumiyawang , yongduan , Dan Williams Subject: [PATCH 5.13 363/380] libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind Date: Thu, 16 Sep 2021 18:02:00 +0200 Message-Id: <20210916155816.405824765@linuxfoundation.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20210916155803.966362085@linuxfoundation.org> References: <20210916155803.966362085@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: sumiyawang commit 32b2397c1e56f33b0b1881def965bb89bd12f448 upstream. There is a use after free crash when the pmem driver tears down its mapping while I/O is still inbound. This is triggered by driver unbind, "ndctl destroy-namespace", while I/O is in flight. Fix the sequence of blk_cleanup_queue() vs memunmap(). The crash signature is of the form: BUG: unable to handle page fault for address: ffffc90080200000 CPU: 36 PID: 9606 Comm: systemd-udevd Call Trace: ? pmem_do_bvec+0xf9/0x3a0 ? xas_alloc+0x55/0xd0 pmem_rw_page+0x4b/0x80 bdev_read_page+0x86/0xb0 do_mpage_readpage+0x5d4/0x7a0 ? lru_cache_add+0xe/0x10 mpage_readpages+0xf9/0x1c0 ? bd_link_disk_holder+0x1a0/0x1a0 blkdev_readpages+0x1d/0x20 read_pages+0x67/0x1a0 ndctl Call Trace in vmcore: PID: 23473 TASK: ffff88c4fbbe8000 CPU: 1 COMMAND: "ndctl" __schedule schedule blk_mq_freeze_queue_wait blk_freeze_queue blk_cleanup_queue pmem_release_queue devm_action_release release_nodes devres_release_all device_release_driver_internal device_driver_detach unbind_store Cc: Signed-off-by: sumiyawang Reviewed-by: yongduan Link: https://lore.kernel.org/r/1629632949-14749-1-git-send-email-sumiyawang@tencent.com Fixes: 50f44ee7248a ("mm/devm_memremap_pages: fix final page put race") Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman --- drivers/nvdimm/pmem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/nvdimm/pmem.c +++ b/drivers/nvdimm/pmem.c @@ -449,11 +449,11 @@ static int pmem_attach_disk(struct devic pmem->pfn_flags |= PFN_MAP; bb_range = pmem->pgmap.range; } else { + addr = devm_memremap(dev, pmem->phys_addr, + pmem->size, ARCH_MEMREMAP_PMEM); if (devm_add_action_or_reset(dev, pmem_release_queue, &pmem->pgmap)) return -ENOMEM; - addr = devm_memremap(dev, pmem->phys_addr, - pmem->size, ARCH_MEMREMAP_PMEM); bb_range.start = res->start; bb_range.end = res->end; }