• Nikolay Borisov's avatar
    btrfs: fix memory ordering between normal and ordered work functions · 45da9c17
    Nikolay Borisov authored
    Ordered work functions aren't guaranteed to be handled by the same thread
    which executed the normal work functions. The only way execution between
    normal/ordered functions is synchronized is via the WORK_DONE_BIT,
    unfortunately the used bitops don't guarantee any ordering whatsoever.
    
    This manifested as seemingly inexplicable crashes on ARM64, where
    async_chunk::inode is seen as non-null in async_cow_submit which causes
    submit_compressed_extents to be called and crash occurs because
    async_chunk::inode suddenly became NULL. The call trace was similar to:
    
        pc : submit_compressed_extents+0x38/0x3d0
        lr : async_cow_submit+0x50/0xd0
        sp : ffff800015d4bc20
    
        <registers omitted for brevity>
    
        Call trace:
         submit_compressed_extents+0x38/0x3d0
         async_cow_submit+0x50/0xd0
         run_ordered_work+0xc8/0x280
         btrfs_work_helper+0x98/0x250
         process_one_work+0x1f0/0x4ac
         worker_thread+0x188/0x504
         kthread+0x110/0x114
         ret_from_fork+0x10/0x18
    
    Fix this by adding respective barrier calls which ensure that all
    accesses preceding setting of WORK_DONE_BIT are strictly ordered before
    setting the flag. At the same time add a read barrier after reading of
    WORK_DONE_BIT in run_ordered_work which ensures all subsequent loads
    would be strictly ordered after reading the bit. This in turn ensures
    are all accesses before WORK_DONE_BIT are going to be strictly ordered
    before any access that can occur in ordered_func.
    Reported-by: default avatarChris Murphy <lists@colorremedies.com>
    Fixes: 08a9ff32 ("btrfs: Added btrfs_workqueue_struct implemented ordered execution based on kernel workqueue")
    CC: stable@vger.kernel.org # 4.4+
    Link: https://bugzilla.redhat.com/show_bug.cgi?id=2011928Reviewed-by: default avatarJosef Bacik <josef@toxicpanda.com>
    Tested-by: default avatarChris Murphy <chris@colorremedies.com>
    Signed-off-by: default avatarNikolay Borisov <nborisov@suse.com>
    Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
    45da9c17
async-thread.c 10.8 KB