• Jia-Ju Bai's avatar
    lightnvm: pblk: fix two sleep-in-atomic-context bugs · 7325b4bb
    Jia-Ju Bai authored
    The driver may sleep with holding a spinlock.
    
    The function call paths (from bottom to top) in Linux-4.16 are:
    
    [FUNC] nvm_dev_dma_alloc(GFP_KERNEL)
    drivers/lightnvm/pblk-core.c, 754:
    	nvm_dev_dma_alloc in pblk_line_submit_smeta_io
    drivers/lightnvm/pblk-core.c, 1048:
    	pblk_line_submit_smeta_io in pblk_line_init_bb
    drivers/lightnvm/pblk-core.c, 1434:
    	pblk_line_init_bb in pblk_line_replace_data
    drivers/lightnvm/pblk-recovery.c, 980:
    	pblk_line_replace_data in pblk_recov_l2p
    drivers/lightnvm/pblk-recovery.c, 976:
    	spin_lock in pblk_recov_l2p
    
    [FUNC] bio_map_kern(GFP_KERNEL)
    drivers/lightnvm/pblk-core.c, 762:
    	bio_map_kern in pblk_line_submit_smeta_io
    drivers/lightnvm/pblk-core.c, 1048:
    	pblk_line_submit_smeta_io in pblk_line_init_bb
    drivers/lightnvm/pblk-core.c, 1434:
    	pblk_line_init_bb in pblk_line_replace_data
    drivers/lightnvm/pblk-recovery.c, 980:
    	pblk_line_replace_data in pblk_recov_l2p
    drivers/lightnvm/pblk-recovery.c, 976:
    	spin_lock in pblk_recov_l2p
    
    To fix these bugs, the call to pblk_line_replace_data()
    is moved out of the spinlock protection.
    
    These bugs are found by my static analysis tool DSAC.
    Signed-off-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
    Reviewed-by: default avatarJavier González <javier@cnexlabs.com>
    Signed-off-by: default avatarMatias Bjørling <mb@lightnvm.io>
    Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
    7325b4bb
pblk-recovery.c 24.6 KB