f2fs: fix potential hangtask in f2fs_trace_pid (4635b46a) · Commits · 戴 / test

As Jia-Ju Bai reported: "According to fs/f2fs/trace.c, the kernel module may sleep under a spinlock. The function call path is: f2fs_trace_pid (acquire the spinlock) f2fs_radix_tree_insert cond_resched --> may sleep I do not find a good way to fix it, so I only report. This possible bug is found by my static analysis tool (DSAC) and my code review." Obviously, it's problemetic to schedule in critical region of spinlock, which will cause uninterruptable sleep if there is no waker. This patch changes to use mutex lock intead of spinlock to avoid this condition. Reported-by:

Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by:

Chao Yu <yuchao0@huawei.com> Signed-off-by:

Jaegeuk Kim <jaegeuk@kernel.org>

fs/f2fs/trace.c

+6 −6

Original line number	Diff line number	Diff line
		@@ -17,7 +17,7 @@
		#include "trace.h"

		static RADIX_TREE(pids, GFP_ATOMIC);
		static spinlock_t pids_lock;
		static struct mutex pids_lock;
		static struct last_io_info last_io;

		static inline void __print_last_io(void)
		@@ -64,7 +64,7 @@ void f2fs_trace_pid(struct page *page)
		if (radix_tree_preload(GFP_NOFS))
		return;

		spin_lock(&pids_lock);
		mutex_lock(&pids_lock);
		p = radix_tree_lookup(&pids, pid);
		if (p == current)
		goto out;
		@@ -77,7 +77,7 @@ void f2fs_trace_pid(struct page *page)
		MAJOR(inode->i_sb->s_dev), MINOR(inode->i_sb->s_dev),
		pid, current->comm);
		out:
		spin_unlock(&pids_lock);
		mutex_unlock(&pids_lock);
		radix_tree_preload_end();
		}

		@@ -122,7 +122,7 @@ void f2fs_trace_ios(struct f2fs_io_info *fio, int flush)

		void f2fs_build_trace_ios(void)
		{
		spin_lock_init(&pids_lock);
		mutex_init(&pids_lock);
		}

		#define PIDVEC_SIZE 128
		@@ -150,7 +150,7 @@ void f2fs_destroy_trace_ios(void)
		pid_t next_pid = 0;
		unsigned int found;

		spin_lock(&pids_lock);
		mutex_lock(&pids_lock);
		while ((found = gang_lookup_pids(pid, next_pid, PIDVEC_SIZE))) {
		unsigned idx;

		@@ -158,5 +158,5 @@ void f2fs_destroy_trace_ios(void)
		for (idx = 0; idx < found; idx++)
		radix_tree_delete(&pids, pid[idx]);
		}
		spin_unlock(&pids_lock);
		mutex_unlock(&pids_lock);
		}

Admin message