Commit 1af2d1f6 authored May 07, 2024 by Li Nan

block: fix deadlock between bd_link_disk_holder and partition scan

mainline inclusion
from mainline-v6.9-rc1
commit 03f12122b20b6e6028e9ed69030a49f9cffcbb75
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9IVH5

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=03f12122b20b6e6028e9ed69030a49f9cffcbb75



--------------------------------

'open_mutex' of gendisk is used to protect open/close block devices. But
in bd_link_disk_holder(), it is used to protect the creation of symlink
between holding disk and slave bdev, which introduces some issues.

When bd_link_disk_holder() is called, the driver is usually in the process
of initialization/modification and may suspend submitting io. At this
time, any io hold 'open_mutex', such as scanning partitions, can cause
deadlocks. For example, in raid:

T1                              T2
bdev_open_by_dev
 lock open_mutex [1]
 ...
  efi_partition
  ...
   md_submit_bio
				md_ioctl mddev_syspend
				  -> suspend all io
				 md_add_new_disk
				  bind_rdev_to_array
				   bd_link_disk_holder
				    try lock open_mutex [2]
    md_handle_request
     -> wait mddev_resume

T1 scan partition, T2 add a new device to raid. T1 waits for T2 to resume
mddev, but T2 waits for open_mutex held by T1. Deadlock occurs.

Fix it by introducing a local mutex 'blk_holder_mutex' to replace
'open_mutex'.

Fixes: 1b0a2d950ee2 ("md: use new apis to suspend array for ioctls involed array reconfiguration")
Reported-by:  <mgperkow@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218459


Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20240221090122.1281868-1-linan666@huaweicloud.com


Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent 1087e901

block/holder.c

+7 −5

Original line number	Diff line number	Diff line
		@@ -8,6 +8,8 @@ struct bd_holder_disk {
		int refcnt;
		};

		static DEFINE_MUTEX(blk_holder_mutex);

		static struct bd_holder_disk bd_find_holder_disk(struct block_device bdev,
		struct gendisk *disk)
		{
		@@ -80,7 +82,7 @@ int bd_link_disk_holder(struct block_device bdev, struct gendisk disk)
		kobject_get(bdev->bd_holder_dir);
		mutex_unlock(&bdev->bd_disk->open_mutex);

		mutex_lock(&disk->open_mutex);
		mutex_lock(&blk_holder_mutex);
		WARN_ON_ONCE(!bdev->bd_holder);

		holder = bd_find_holder_disk(bdev, disk);
		@@ -108,7 +110,7 @@ int bd_link_disk_holder(struct block_device bdev, struct gendisk disk)
		goto out_del_symlink;
		list_add(&holder->list, &disk->slave_bdevs);

		mutex_unlock(&disk->open_mutex);
		mutex_unlock(&blk_holder_mutex);
		return 0;

		out_del_symlink:
		@@ -116,7 +118,7 @@ int bd_link_disk_holder(struct block_device bdev, struct gendisk disk)
		out_free_holder:
		kfree(holder);
		out_unlock:
		mutex_unlock(&disk->open_mutex);
		mutex_unlock(&blk_holder_mutex);
		if (ret)
		kobject_put(bdev->bd_holder_dir);
		return ret;
		@@ -140,7 +142,7 @@ void bd_unlink_disk_holder(struct block_device bdev, struct gendisk disk)
		if (WARN_ON_ONCE(!disk->slave_dir))
		return;

		mutex_lock(&disk->open_mutex);
		mutex_lock(&blk_holder_mutex);
		holder = bd_find_holder_disk(bdev, disk);
		if (!WARN_ON_ONCE(holder == NULL) && !--holder->refcnt) {
		del_symlink(disk->slave_dir, bdev_kobj(bdev));
		@@ -149,6 +151,6 @@ void bd_unlink_disk_holder(struct block_device bdev, struct gendisk disk)
		list_del_init(&holder->list);
		kfree(holder);
		}
		mutex_unlock(&disk->open_mutex);
		mutex_unlock(&blk_holder_mutex);
		}
		EXPORT_SYMBOL_GPL(bd_unlink_disk_holder);