bcache: fixup multiple threads crash

When multiple threads to check btree nodes in parallel, the main
thread wait for all threads to stop or CACHE_SET_IO_DISABLE flag:

wait_event_interruptible(check_state->wait,
                         atomic_read(&check_state->started) == 0 ||
                         test_bit(CACHE_SET_IO_DISABLE, &c->flags));

However, the bch_btree_node_read and bch_btree_node_read_done
maybe call bch_cache_set_error, then the CACHE_SET_IO_DISABLE
will be set. If the flag already set, the main thread return
error. At the same time, maybe some threads still running and
read NULL pointer, the kernel will crash.

This patch change the event wait condition, the main thread must
wait for all threads to stop.

Fixes: 8e7102273f597 ("bcache: make bch_btree_check() to be multithreaded")
Signed-off-by: Mingzhe Zou <mingzhe.zou@easystack.cn>
Cc: stable@vger.kernel.org # v5.7+
Signed-off-by: Coly Li <colyli@suse.de>

diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 88c573eeb59823bd38ddb38d51b14099fec0f935..ad9f16689419d31bc614e2546d9d5f18a82e72e3 100644 (file)
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -2060,9 +2060,11 @@ int bch_btree_check(struct cache_set *c)
                }
        }
 
+       /*
+        * Must wait for all threads to stop.
+        */
        wait_event_interruptible(check_state->wait,
-                                atomic_read(&check_state->started) == 0 ||
-                                 test_bit(CACHE_SET_IO_DISABLE, &c->flags));
+                                atomic_read(&check_state->started) == 0);
 
        for (i = 0; i < check_state->total_threads; i++) {
                if (check_state->infos[i].result) {

diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 176461f89f46f84d342735c5fa6b1e607b0038f9..9ee0005874cda2621013edc4c73366690b8f1039 100644 (file)
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -1001,9 +1001,11 @@ void bch_sectors_dirty_init(struct bcache_device *d)
                }
        }
 
+       /*
+        * Must wait for all threads to stop.
+        */
        wait_event_interruptible(state->wait,
-                atomic_read(&state->started) == 0 ||
-                test_bit(CACHE_SET_IO_DISABLE, &c->flags));
+                atomic_read(&state->started) == 0);
 
 out:
        kfree(state);