Message ID | 20210924093917.1953239-1-yangerkun@huawei.com |
---|---|
State | Awaiting Upstream |
Headers | show |
Series | [v3] ext4: flush s_error_work before journal destroy in ext4_fill_super | expand |
On Fri, 24 Sep 2021 17:39:17 +0800, yangerkun wrote: > The error path in ext4_fill_super forget to flush s_error_work before > journal destroy, and it may trigger the follow bug since > flush_stashed_error_work can run concurrently with journal destroy > without any protection for sbi->s_journal. > > [32031.740193] EXT4-fs (loop66): get root inode failed > [32031.740484] EXT4-fs (loop66): mount failed > [32031.759805] ------------[ cut here ]------------ > [32031.759807] kernel BUG at fs/jbd2/transaction.c:373! > [32031.760075] invalid opcode: 0000 [#1] SMP PTI > [32031.760336] CPU: 5 PID: 1029268 Comm: kworker/5:1 Kdump: loaded > 4.18.0 > [32031.765112] Call Trace: > [32031.765375] ? __switch_to_asm+0x35/0x70 > [32031.765635] ? __switch_to_asm+0x41/0x70 > [32031.765893] ? __switch_to_asm+0x35/0x70 > [32031.766148] ? __switch_to_asm+0x41/0x70 > [32031.766405] ? _cond_resched+0x15/0x40 > [32031.766665] jbd2__journal_start+0xf1/0x1f0 [jbd2] > [32031.766934] jbd2_journal_start+0x19/0x20 [jbd2] > [32031.767218] flush_stashed_error_work+0x30/0x90 [ext4] > [32031.767487] process_one_work+0x195/0x390 > [32031.767747] worker_thread+0x30/0x390 > [32031.768007] ? process_one_work+0x390/0x390 > [32031.768265] kthread+0x10d/0x130 > [32031.768521] ? kthread_flush_work_fn+0x10/0x10 > [32031.768778] ret_from_fork+0x35/0x40 > > [...] Applied, thanks! [1/1] ext4: flush s_error_work before journal destroy in ext4_fill_super commit: 5ded76080628728881a5e6e7d2e06425cfe4ea1a Best regards,
diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 0775950ee84e..45a3df280e23 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -658,7 +658,7 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error, * constraints, it may not be safe to do it right here so we * defer superblock flushing to a workqueue. */ - if (continue_fs) + if (continue_fs && journal) schedule_work(&EXT4_SB(sb)->s_error_work); else ext4_commit_super(sb); @@ -5042,12 +5042,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) sbi->s_ea_block_cache = NULL; if (sbi->s_journal) { + /* flush s_error_work before journal destroy. */ + flush_work(&sbi->s_error_work); jbd2_journal_destroy(sbi->s_journal); sbi->s_journal = NULL; } failed_mount3a: ext4_es_unregister_shrinker(sbi); failed_mount3: + /* flush s_error_work before sbi destroy */ flush_work(&sbi->s_error_work); del_timer_sync(&sbi->s_err_report); ext4_stop_mmpd(sbi);