Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4635b46a authored by Chao Yu's avatar Chao Yu Committed by Jaegeuk Kim
Browse files

f2fs: fix potential hangtask in f2fs_trace_pid 



As Jia-Ju Bai reported:

"According to fs/f2fs/trace.c, the kernel module may sleep under a spinlock.
The function call path is:
f2fs_trace_pid (acquire the spinlock)
   f2fs_radix_tree_insert
     cond_resched --> may sleep

I do not find a good way to fix it, so I only report.
This possible bug is found by my static analysis tool (DSAC) and my code
review."

Obviously, it's problemetic to schedule in critical region of spinlock,
which will cause uninterruptable sleep if there is no waker.

This patch changes to use mutex lock intead of spinlock to avoid this
condition.

Reported-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: default avatarChao Yu <yuchao0@huawei.com>
Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
parent c376fc0f

fs/f2fs/trace.c

+6 −6
Original line number Diff line number Diff line
@@ -17,7 +17,7 @@ 
#include "trace.h"



static RADIX_TREE(pids, GFP_ATOMIC);

static spinlock_t pids_lock;

static struct mutex pids_lock;

static struct last_io_info last_io;



static inline void __print_last_io(void)
@@ -64,7 +64,7 @@ void f2fs_trace_pid(struct page *page) 
	if (radix_tree_preload(GFP_NOFS))

		return;



	spin_lock(&pids_lock);

	mutex_lock(&pids_lock);

	p = radix_tree_lookup(&pids, pid);

	if (p == current)

		goto out;
@@ -77,7 +77,7 @@ void f2fs_trace_pid(struct page *page) 
			MAJOR(inode->i_sb->s_dev), MINOR(inode->i_sb->s_dev),

			pid, current->comm);

out:

	spin_unlock(&pids_lock);

	mutex_unlock(&pids_lock);

	radix_tree_preload_end();

}
@@ -122,7 +122,7 @@ void f2fs_trace_ios(struct f2fs_io_info *fio, int flush) 


void f2fs_build_trace_ios(void)

{

	spin_lock_init(&pids_lock);

	mutex_init(&pids_lock);

}



#define PIDVEC_SIZE	128
@@ -150,7 +150,7 @@ void f2fs_destroy_trace_ios(void) 
	pid_t next_pid = 0;

	unsigned int found;



	spin_lock(&pids_lock);

	mutex_lock(&pids_lock);

	while ((found = gang_lookup_pids(pid, next_pid, PIDVEC_SIZE))) {

		unsigned idx;
@@ -158,5 +158,5 @@ void f2fs_destroy_trace_ios(void) 
		for (idx = 0; idx < found; idx++)

			radix_tree_delete(&pids, pid[idx]);

	}

	spin_unlock(&pids_lock);

	mutex_unlock(&pids_lock);

}