sumiyawang b2e72e53cd libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind ... commit 32b2397c1e56f33b0b1881def965bb89bd12f448 upstream. There is a use after free crash when the pmem driver tears down its mapping while I/O is still inbound. This is triggered by driver unbind, "ndctl destroy-namespace", while I/O is in flight. Fix the sequence of blk_cleanup_queue() vs memunmap(). The crash signature is of the form: BUG: unable to handle page fault for address: ffffc90080200000 CPU: 36 PID: 9606 Comm: systemd-udevd Call Trace: ? pmem_do_bvec+0xf9/0x3a0 ? xas_alloc+0x55/0xd0 pmem_rw_page+0x4b/0x80 bdev_read_page+0x86/0xb0 do_mpage_readpage+0x5d4/0x7a0 ? lru_cache_add+0xe/0x10 mpage_readpages+0xf9/0x1c0 ? bd_link_disk_holder+0x1a0/0x1a0 blkdev_readpages+0x1d/0x20 read_pages+0x67/0x1a0 ndctl Call Trace in vmcore: PID: 23473 TASK: ffff88c4fbbe8000 CPU: 1 COMMAND: "ndctl" __schedule schedule blk_mq_freeze_queue_wait blk_freeze_queue blk_cleanup_queue pmem_release_queue devm_action_release release_nodes devres_release_all device_release_driver_internal device_driver_detach unbind_store Cc: <stable@vger.kernel.org> Signed-off-by: sumiyawang <sumiyawang@tencent.com> Reviewed-by: yongduan <yongduan@tencent.com> Link: https://lore.kernel.org/r/1629632949-14749-1-git-send-email-sumiyawang@tencent.com Fixes: 50f44ee724 ("mm/devm_memremap_pages: fix final page put race") Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-09-18 13:40:36 +02:00
..
badrange.c	mm/memremap_pages: convert to 'struct range'	2020-10-13 18:38:28 -07:00
blk.c	nvdimm: simplify revalidate_disk handling	2020-09-02 08:00:07 -06:00
btt_devs.c
btt.c	bdi: remove BDI_CAP_SYNCHRONOUS_IO	2020-09-24 13:43:39 -06:00
btt.h
bus.c	nvdimm: simplify revalidate_disk handling	2020-09-02 08:00:07 -06:00
claim.c	mm/memremap_pages: convert to 'struct range'	2020-10-13 18:38:28 -07:00
core.c
dax_devs.c
dimm_devs.c	libnvdimm/dimm: Avoid race between probe and available_slots_show()	2021-02-10 09:29:17 +01:00
dimm.c
e820.c
Kconfig
label.c	libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels	2020-12-30 11:54:27 +01:00
label.h
Makefile
namespace_devs.c	libnvdimm/region: Fix label activation vs errors	2021-08-18 08:59:07 +02:00
nd_virtio.c
nd-core.h
nd.h	mm/memremap_pages: convert to 'struct range'	2020-10-13 18:38:28 -07:00
of_pmem.c
pfn_devs.c	mm/memremap_pages: support multiple ranges per invocation	2020-10-13 18:38:28 -07:00
pfn.h
pmem.c	libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind	2021-09-18 13:40:36 +02:00
pmem.h
region_devs.c	libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC	2021-04-21 13:00:55 +02:00
region.c	mm/memremap_pages: convert to 'struct range'	2020-10-13 18:38:28 -07:00
security.c
virtio_pmem.c
virtio_pmem.h