The nd_pmem_notify() routine is called whenever an ARS
(address-range-scrub) completes to communicate results to the
per-namespace badblocks instances.
When the namespace is in btt mode we crash because we do not allocate a
struct pmem_device instance in that case. Resulting in the following
crash signature:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
IP: nd_pmem_notify+0x30/0xf0 [nd_pmem]
Call Trace:
nd_device_notify+0x40/0x50
child_notify+0x10/0x20
device_for_each_child+0x50/0x90
nd_region_notify+0x20/0x30
nd_device_notify+0x40/0x50
nvdimm_region_notify+0x27/0x30
acpi_nfit_scrub+0x341/0x590 [nfit]
process_one_work+0x197/0x450
worker_thread+0x4e/0x4a0
kthread+0x109/0x140
Given that we don't even populate the btt badblocks instance, just
return early and skip the device to region lookup.
This is a simpler version of the original fix by Toshi [1].
[1]: https://patchwork.kernel.org/patch/9700055/
Cc: Vishal Verma <[email protected]>
Reported-by: Toshi Kani <[email protected]>
Signed-off-by: Dan Williams <[email protected]>
---
drivers/nvdimm/pmem.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 5b536be5a12e..ee6cd31dafcf 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -388,21 +388,21 @@ static void nd_pmem_shutdown(struct device *dev)
static void nd_pmem_notify(struct device *dev, enum nvdimm_event event)
{
- struct pmem_device *pmem = dev_get_drvdata(dev);
- struct nd_region *nd_region = to_region(pmem);
resource_size_t offset = 0, end_trunc = 0;
struct nd_namespace_common *ndns;
struct nd_namespace_io *nsio;
+ struct nd_region *nd_region;
+ struct pmem_device *pmem;
struct resource res;
if (event != NVDIMM_REVALIDATE_POISON)
return;
- if (is_nd_btt(dev)) {
- struct nd_btt *nd_btt = to_nd_btt(dev);
+ /* no badblocks instance to update in the btt case */
+ if (is_nd_btt(dev))
+ return;
- ndns = nd_btt->ndns;
- } else if (is_nd_pfn(dev)) {
+ if (is_nd_pfn(dev)) {
struct nd_pfn *nd_pfn = to_nd_pfn(dev);
struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb;
@@ -415,6 +415,8 @@ static void nd_pmem_notify(struct device *dev, enum nvdimm_event event)
nsio = to_nd_namespace_io(&ndns->dev);
res.start = nsio->res.start + offset;
res.end = nsio->res.end - end_trunc;
+ pmem = dev_get_drvdata(dev);
+ nd_region = to_region(pmem);
nvdimm_badblocks_populate(nd_region, &pmem->bb, &res);
}
On Thu, 2017-04-27 at 15:10 -0700, Dan Williams wrote:
> The nd_pmem_notify() routine is called whenever an ARS
> (address-range-scrub) completes to communicate results to the
> per-namespace badblocks instances.
>
> When the namespace is in btt mode we crash because we do not allocate
> a struct pmem_device instance in that case. Resulting in the
> following crash signature:
>
> BUG: unable to handle kernel NULL pointer dereference at
> 0000000000000030
> IP: nd_pmem_notify+0x30/0xf0 [nd_pmem]
> Call Trace:
> nd_device_notify+0x40/0x50
> child_notify+0x10/0x20
> device_for_each_child+0x50/0x90
> nd_region_notify+0x20/0x30
> nd_device_notify+0x40/0x50
> nvdimm_region_notify+0x27/0x30
> acpi_nfit_scrub+0x341/0x590 [nfit]
> process_one_work+0x197/0x450
> worker_thread+0x4e/0x4a0
> kthread+0x109/0x140
>
> Given that we don't even populate the btt badblocks instance, just
> return early and skip the device to region lookup.
We populate the btt badblocks into nsio->bb, and check/clear them in
nsio_rw_bytes().
Thanks,
-Toshi
On Thu, Apr 27, 2017 at 3:25 PM, Kani, Toshimitsu <[email protected]> wrote:
> On Thu, 2017-04-27 at 15:10 -0700, Dan Williams wrote:
>> The nd_pmem_notify() routine is called whenever an ARS
>> (address-range-scrub) completes to communicate results to the
>> per-namespace badblocks instances.
>>
>> When the namespace is in btt mode we crash because we do not allocate
>> a struct pmem_device instance in that case. Resulting in the
>> following crash signature:
>>
>> BUG: unable to handle kernel NULL pointer dereference at
>> 0000000000000030
>> IP: nd_pmem_notify+0x30/0xf0 [nd_pmem]
>> Call Trace:
>> nd_device_notify+0x40/0x50
>> child_notify+0x10/0x20
>> device_for_each_child+0x50/0x90
>> nd_region_notify+0x20/0x30
>> nd_device_notify+0x40/0x50
>> nvdimm_region_notify+0x27/0x30
>> acpi_nfit_scrub+0x341/0x590 [nfit]
>> process_one_work+0x197/0x450
>> worker_thread+0x4e/0x4a0
>> kthread+0x109/0x140
>>
>> Given that we don't even populate the btt badblocks instance, just
>> return early and skip the device to region lookup.
>
> We populate the btt badblocks into nsio->bb, and check/clear them in
> nsio_rw_bytes().
Argh, yes, we don't populate them out to the disk badblocks. I'll go
with your patch.
On Thu, 2017-04-27 at 15:26 -0700, Dan Williams wrote:
> On Thu, Apr 27, 2017 at 3:25 PM, Kani, Toshimitsu <[email protected]
> > wrote:
> > On Thu, 2017-04-27 at 15:10 -0700, Dan Williams wrote:
> > > The nd_pmem_notify() routine is called whenever an ARS
> > > (address-range-scrub) completes to communicate results to the
> > > per-namespace badblocks instances.
> > >
> > > When the namespace is in btt mode we crash because we do not
> > > allocate a struct pmem_device instance in that case. Resulting in
> > > the following crash signature:
> > >
> > > BUG: unable to handle kernel NULL pointer dereference at
> > > 0000000000000030
> > > IP: nd_pmem_notify+0x30/0xf0 [nd_pmem]
> > > Call Trace:
> > > nd_device_notify+0x40/0x50
> > > child_notify+0x10/0x20
> > > device_for_each_child+0x50/0x90
> > > nd_region_notify+0x20/0x30
> > > nd_device_notify+0x40/0x50
> > > nvdimm_region_notify+0x27/0x30
> > > acpi_nfit_scrub+0x341/0x590 [nfit]
> > > process_one_work+0x197/0x450
> > > worker_thread+0x4e/0x4a0
> > > kthread+0x109/0x140
> > >
> > > Given that we don't even populate the btt badblocks instance,
> > > just return early and skip the device to region lookup.
> >
> > We populate the btt badblocks into nsio->bb, and check/clear them
> > in nsio_rw_bytes().
>
> Argh, yes, we don't populate them out to the disk badblocks. I'll go
> with your patch.
Thanks!
-Toshi