lkml.org 
[lkml]   [2022]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 180/772] scsi: target: tcmu: Avoid holding XArray lock when calling lock_page
    Date
    From: Bodo Stroesser <bostroesser@gmail.com>

    [ Upstream commit 325d5c5fb216674296f3902a8902b942da3adc5b ]

    In tcmu_blocks_release(), lock_page() is called to prevent a race causing
    possible data corruption. Since lock_page() might sleep, calling it while
    holding XArray lock is a bug.

    To fix this, replace the xas_for_each() call with xa_for_each_range().
    Since the latter does its own handling of XArray locking, the xas_lock()
    and xas_unlock() calls around the original loop are no longer necessary.

    The switch to xa_for_each_range() slows down the loop slightly. This is
    acceptable since tcmu_blocks_release() is not relevant for performance.

    Link: https://lore.kernel.org/r/20220517192913.21405-1-bostroesser@gmail.com
    Fixes: bb9b9eb0ae2e ("scsi: target: tcmu: Fix possible data corruption")
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Bodo Stroesser <bostroesser@gmail.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/target/target_core_user.c | 10 +++++-----
    1 file changed, 5 insertions(+), 5 deletions(-)

    diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
    index f26767a55d38..826b55caa17f 100644
    --- a/drivers/target/target_core_user.c
    +++ b/drivers/target/target_core_user.c
    @@ -1660,13 +1660,14 @@ static int tcmu_check_and_free_pending_cmd(struct tcmu_cmd *cmd)
    static u32 tcmu_blocks_release(struct tcmu_dev *udev, unsigned long first,
    unsigned long last)
    {
    - XA_STATE(xas, &udev->data_pages, first * udev->data_pages_per_blk);
    struct page *page;
    + unsigned long dpi;
    u32 pages_freed = 0;

    - xas_lock(&xas);
    - xas_for_each(&xas, page, (last + 1) * udev->data_pages_per_blk - 1) {
    - xas_store(&xas, NULL);
    + first = first * udev->data_pages_per_blk;
    + last = (last + 1) * udev->data_pages_per_blk - 1;
    + xa_for_each_range(&udev->data_pages, dpi, page, first, last) {
    + xa_erase(&udev->data_pages, dpi);
    /*
    * While reaching here there may be page faults occurring on
    * the to-be-released pages. A race condition may occur if
    @@ -1690,7 +1691,6 @@ static u32 tcmu_blocks_release(struct tcmu_dev *udev, unsigned long first,
    __free_page(page);
    pages_freed++;
    }
    - xas_unlock(&xas);

    atomic_sub(pages_freed, &global_page_count);

    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-07 22:47    [W:3.901 / U:0.188 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site