| From 297ba57dcdec7ea37e702bcf1a577ac32a034e21 Mon Sep 17 00:00:00 2001 |
| From: Bart Van Assche <bart.vanassche@wdc.com> |
| Date: Wed, 27 Jun 2018 12:55:18 -0700 |
| Subject: block: Fix cloning of requests with a special payload |
| |
| From: Bart Van Assche <bart.vanassche@wdc.com> |
| |
| commit 297ba57dcdec7ea37e702bcf1a577ac32a034e21 upstream. |
| |
| This patch avoids that removing a path controlled by the dm-mpath driver |
| while mkfs is running triggers the following kernel bug: |
| |
| kernel BUG at block/blk-core.c:3347! |
| invalid opcode: 0000 [#1] PREEMPT SMP KASAN |
| CPU: 20 PID: 24369 Comm: mkfs.ext4 Not tainted 4.18.0-rc1-dbg+ #2 |
| RIP: 0010:blk_end_request_all+0x68/0x70 |
| Call Trace: |
| <IRQ> |
| dm_softirq_done+0x326/0x3d0 [dm_mod] |
| blk_done_softirq+0x19b/0x1e0 |
| __do_softirq+0x128/0x60d |
| irq_exit+0x100/0x110 |
| smp_call_function_single_interrupt+0x90/0x330 |
| call_function_single_interrupt+0xf/0x20 |
| </IRQ> |
| |
| Fixes: f9d03f96b988 ("block: improve handling of the magic discard payload") |
| Reviewed-by: Ming Lei <ming.lei@redhat.com> |
| Reviewed-by: Christoph Hellwig <hch@lst.de> |
| Acked-by: Mike Snitzer <snitzer@redhat.com> |
| Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com> |
| Cc: Hannes Reinecke <hare@suse.com> |
| Cc: Johannes Thumshirn <jthumshirn@suse.de> |
| Cc: <stable@vger.kernel.org> |
| Signed-off-by: Jens Axboe <axboe@kernel.dk> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| block/blk-core.c | 4 ++++ |
| 1 file changed, 4 insertions(+) |
| |
| --- a/block/blk-core.c |
| +++ b/block/blk-core.c |
| @@ -3487,6 +3487,10 @@ static void __blk_rq_prep_clone(struct r |
| dst->cpu = src->cpu; |
| dst->__sector = blk_rq_pos(src); |
| dst->__data_len = blk_rq_bytes(src); |
| + if (src->rq_flags & RQF_SPECIAL_PAYLOAD) { |
| + dst->rq_flags |= RQF_SPECIAL_PAYLOAD; |
| + dst->special_vec = src->special_vec; |
| + } |
| dst->nr_phys_segments = src->nr_phys_segments; |
| dst->ioprio = src->ioprio; |
| dst->extra_len = src->extra_len; |
