bcache: fixup multiple threads crash

commit 887554ab96588de2917b6c8c73e552da082e5368 upstream.

When multiple threads to check btree nodes in parallel, the main
thread wait for all threads to stop or CACHE_SET_IO_DISABLE flag:

wait_event_interruptible(check_state->wait,
                         atomic_read(&check_state->started) == 0 ||
                         test_bit(CACHE_SET_IO_DISABLE, &c->flags));

However, the bch_btree_node_read and bch_btree_node_read_done
maybe call bch_cache_set_error, then the CACHE_SET_IO_DISABLE
will be set. If the flag already set, the main thread return
error. At the same time, maybe some threads still running and
read NULL pointer, the kernel will crash.

This patch change the event wait condition, the main thread must
wait for all threads to stop.

Fixes: 8e7102273f597 ("bcache: make bch_btree_check() to be multithreaded")
Signed-off-by: Mingzhe Zou <mingzhe.zou@easystack.cn>
Cc: stable@vger.kernel.org # v5.7+
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 183a58c893774d59f46c02070d84462d454bb3a7..8eecc9df319b56f14a8038dfba1d9fa2f1ce564b 100644 (file)
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -2060,9 +2060,11 @@ int bch_btree_check(struct cache_set *c)
                }
        }
 
+       /*
+        * Must wait for all threads to stop.
+        */
        wait_event_interruptible(check_state->wait,
-                                atomic_read(&check_state->started) == 0 ||
-                                 test_bit(CACHE_SET_IO_DISABLE, &c->flags));
+                                atomic_read(&check_state->started) == 0);
 
        for (i = 0; i < check_state->total_threads; i++) {
                if (check_state->infos[i].result) {

diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 8120da278161e9c8b3a220500b506805e2828bfe..1c03a3b72f8aaffa7cea5f21bd68091244a5fca2 100644 (file)
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -998,9 +998,11 @@ void bch_sectors_dirty_init(struct bcache_device *d)
                }
        }
 
+       /*
+        * Must wait for all threads to stop.
+        */
        wait_event_interruptible(state->wait,
-                atomic_read(&state->started) == 0 ||
-                test_bit(CACHE_SET_IO_DISABLE, &c->flags));
+                atomic_read(&state->started) == 0);
 
 out:
        kfree(state);