Merge tag 'for-linus-20180906' of git://git.kernel.dk/linux-block

Pull block fixes from Jens Axboe: "Small collection of fixes that should go into this release. This contains: - Small series that fixes a race between blkcg teardown and writeback (Dennis Zhou) - Fix disallowing invalid block size settings from the nbd ioctl (me) - BFQ fix for a use-after-free on last release of a bfqg (Konstantin Khlebnikov) - Fix for the "don't warn for flush" fix (Mikulas)" * tag 'for-linus-20180906' of git://git.kernel.dk/linux-block: block: bfq: swap puts in bfqg_and_blkg_put block: don't warn when doing fsync on read-only devices nbd: don't allow invalid blocksize settings blkcg: use tryget logic when associating a blkg with a bio blkcg: delay blkg destruction until after writeback has finished Revert "blk-throttle: fix race between blkcg_bio_issue_check() and cgroup_rmdir()"

Linus Torvalds committed 8 years ago

Commit ca16eb32 parents db44bf4 d5274b38 files · +111 −64Browse files

Unified · Split

8 files

block/bfq-cgroup.c +2 −2
block/bio.c +2 −1
block/blk-cgroup.c +48 −57
block/blk-core.c +4 −1
block/blk-throttle.c +3 −2
drivers/block/nbd.c +3 −0
include/linux/blk-cgroup.h +44 −1
mm/backing-dev.c +5 −0

block/bfq-cgroup.c+2−2

@@ -275,9 +275,9 @@ static void bfqg_and_blkg_get(struct bfq_group *bfqg) · 274 unmodified lines
275		275
276	void bfqg_and_blkg_put(struct bfq_group *bfqg)	276	void bfqg_and_blkg_put(struct bfq_group *bfqg)
277	{	277	{
278	bfqg_put(bfqg);
279
280	blkg_put(bfqg_to_blkg(bfqg));	278	blkg_put(bfqg_to_blkg(bfqg));
		279
		280	bfqg_put(bfqg);
281	}	281	}
282		282
283	/* @stats = 0 */	283	/* @stats = 0 */

block/bio.c+2−1

 {
 	if (unlikely(bio->bi_blkg))
 		return -EBUSY;
-	blkg_get(blkg);
+	if (!blkg_try_get(blkg))
+		return -ENODEV;
 	bio->bi_blkg = blkg;
 	return 0;
 }

block/blk-cgroup.c+48−57

 	}
 }
-static void blkg_pd_offline(struct blkcg_gq *blkg)
-{
-	int i;
-	lockdep_assert_held(blkg->q->queue_lock);
-	lockdep_assert_held(&blkg->blkcg->lock);
-	for (i = 0; i < BLKCG_MAX_POLS; i++) {
-		struct blkcg_policy *pol = blkcg_policy[i];
-		if (blkg->pd[i] && !blkg->pd[i]->offline &&
-		    pol->pd_offline_fn) {
-			pol->pd_offline_fn(blkg->pd[i]);
-			blkg->pd[i]->offline = true;
-		}
-	}
-}
 static void blkg_destroy(struct blkcg_gq *blkg)
 {
 	struct blkcg *blkcg = blkg->blkcg;
 	struct blkcg_gq *parent = blkg->parent;
+	int i;
 	lockdep_assert_held(blkg->q->queue_lock);
 	lockdep_assert_held(&blkcg->lock);
 	WARN_ON_ONCE(list_empty(&blkg->q_node));
 	WARN_ON_ONCE(hlist_unhashed(&blkg->blkcg_node));
+	for (i = 0; i < BLKCG_MAX_POLS; i++) {
+		struct blkcg_policy *pol = blkcg_policy[i];
+		if (blkg->pd[i] && pol->pd_offline_fn)
+			pol->pd_offline_fn(blkg->pd[i]);
+	}
 	if (parent) {
 		blkg_rwstat_add_aux(&parent->stat_bytes, &blkg->stat_bytes);
 		blkg_rwstat_add_aux(&parent->stat_ios, &blkg->stat_ios);
 		struct blkcg *blkcg = blkg->blkcg;
 		spin_lock(&blkcg->lock);
-		blkg_pd_offline(blkg);
 		blkg_destroy(blkg);
 		spin_unlock(&blkcg->lock);
 	}
 	{ }	/* terminate */
 };
+/*
+ * blkcg destruction is a three-stage process.
+ *
+ * 1. Destruction starts.  The blkcg_css_offline() callback is invoked
+ *    which offlines writeback.  Here we tie the next stage of blkg destruction
+ *    to the completion of writeback associated with the blkcg.  This lets us
+ *    avoid punting potentially large amounts of outstanding writeback to root
+ *    while maintaining any ongoing policies.  The next stage is triggered when
+ *    the nr_cgwbs count goes to zero.
+ *
+ * 2. When the nr_cgwbs count goes to zero, blkcg_destroy_blkgs() is called
+ *    and handles the destruction of blkgs.  Here the css reference held by
+ *    the blkg is put back eventually allowing blkcg_css_free() to be called.
+ *    This work may occur in cgwb_release_workfn() on the cgwb_release
+ *    workqueue.  Any submitted ios that fail to get the blkg ref will be
+ *    punted to the root_blkg.
+ *
+ * 3. Once the blkcg ref count goes to zero, blkcg_css_free() is called.
+ *    This finally frees the blkcg.
+ */
 /**
  * blkcg_css_offline - cgroup css_offline callback
  * @css: css of interest
  *
- * This function is called when @css is about to go away and responsible
+ * This function is called when @css is about to go away.  Here the cgwbs are
- * for offlining all blkgs pd and killing all wbs associated with @css.
+ * offlined first and only once writeback associated with the blkcg has
- * blkgs pd offline should be done while holding both q and blkcg locks.
+ * finished do we start step 2 (see above).
- * As blkcg lock is nested inside q lock, this function performs reverse
- * double lock dancing.
- *
- * This is the blkcg counterpart of ioc_release_fn().
  */
 static void blkcg_css_offline(struct cgroup_subsys_state *css)
 {
 	struct blkcg *blkcg = css_to_blkcg(css);
-	struct blkcg_gq *blkg;
-	spin_lock_irq(&blkcg->lock);
-	hlist_for_each_entry(blkg, &blkcg->blkg_list, blkcg_node) {
-		struct request_queue *q = blkg->q;
-		if (spin_trylock(q->queue_lock)) {
-			blkg_pd_offline(blkg);
-			spin_unlock(q->queue_lock);
-		} else {
-			spin_unlock_irq(&blkcg->lock);
-			cpu_relax();
-			spin_lock_irq(&blkcg->lock);
-		}
-	}
-	spin_unlock_irq(&blkcg->lock);
+	/* this prevents anyone from attaching or migrating to this blkcg */
 	wb_blkcg_offline(blkcg);
+	/* put the base cgwb reference allowing step 2 to be triggered */
+	blkcg_cgwb_put(blkcg);
 }
 /**
- * blkcg_destroy_all_blkgs - destroy all blkgs associated with a blkcg
+ * blkcg_destroy_blkgs - responsible for shooting down blkgs
  * @blkcg: blkcg of interest
  *
- * This function is called when blkcg css is about to free and responsible for
+ * blkgs should be removed while holding both q and blkcg locks.  As blkcg lock
- * destroying all blkgs associated with @blkcg.
- * blkgs should be removed while holding both q and blkcg locks. As blkcg lock
  * is nested inside q lock, this function performs reverse double lock dancing.
+ * Destroying the blkgs releases the reference held on the blkcg's css allowing
+ * blkcg_css_free to eventually be called.
+ *
+ * This is the blkcg counterpart of ioc_release_fn().
  */
-static void blkcg_destroy_all_blkgs(struct blkcg *blkcg)
+void blkcg_destroy_blkgs(struct blkcg *blkcg)
 {
 	spin_lock_irq(&blkcg->lock);
 	while (!hlist_empty(&blkcg->blkg_list)) {
 		struct blkcg_gq *blkg = hlist_entry(blkcg->blkg_list.first,
-						    struct blkcg_gq,
+						struct blkcg_gq, blkcg_node);
-						    blkcg_node);
 		struct request_queue *q = blkg->q;
 		if (spin_trylock(q->queue_lock)) {
 			spin_lock_irq(&blkcg->lock);
 		}
 	}
 	spin_unlock_irq(&blkcg->lock);
 }
 	struct blkcg *blkcg = css_to_blkcg(css);
 	int i;
-	blkcg_destroy_all_blkgs(blkcg);
 	mutex_lock(&blkcg_pol_mutex);
 	list_del(&blkcg->all_blkcgs_node);
 	INIT_HLIST_HEAD(&blkcg->blkg_list);
 #ifdef CONFIG_CGROUP_WRITEBACK
 	INIT_LIST_HEAD(&blkcg->cgwb_list);
+	refcount_set(&blkcg->cgwb_refcnt, 1);
 #endif
 	list_add_tail(&blkcg->all_blkcgs_node, &all_blkcgs);
 	list_for_each_entry(blkg, &q->blkg_list, q_node) {
 		if (blkg->pd[pol->plid]) {
-			if (!blkg->pd[pol->plid]->offline &&
+			if (pol->pd_offline_fn)
-			    pol->pd_offline_fn) {
 				pol->pd_offline_fn(blkg->pd[pol->plid]);
-				blkg->pd[pol->plid]->offline = true;
-			}
 			pol->pd_free_fn(blkg->pd[pol->plid]);
 			blkg->pd[pol->plid] = NULL;
 		}

block/blk-core.c+4−1

 {
 	const int op = bio_op(bio);
-	if (part->policy && (op_is_write(op) && !op_is_flush(op))) {
+	if (part->policy && op_is_write(op)) {
 		char b[BDEVNAME_SIZE];
+		if (op_is_flush(bio->bi_opf) && !bio_sectors(bio))
+			return false;
 		WARN_ONCE(1,
 		       "generic_make_request: Trying to write "
 			"to read-only block-device %s (partno %d)\n",

block/blk-throttle.c+3−2

 static void blk_throtl_assoc_bio(struct throtl_grp *tg, struct bio *bio)
 {
 #ifdef CONFIG_BLK_DEV_THROTTLING_LOW
-	if (bio->bi_css)
+	/* fallback to root_blkg if we fail to get a blkg ref */
-		bio_associate_blkg(bio, tg_to_blkg(tg));
+	if (bio->bi_css && (bio_associate_blkg(bio, tg_to_blkg(tg)) == -ENODEV))
+		bio_associate_blkg(bio, bio->bi_disk->queue->root_blkg);
 	bio_issue_init(&bio->bi_issue, bio_sectors(bio));
 #endif
 }

drivers/block/nbd.c+3−0

 	case NBD_SET_SOCK:
 		return nbd_add_socket(nbd, arg, false);
 	case NBD_SET_BLKSIZE:
+		if (!arg || !is_power_of_2(arg) || arg < 512 ||
+		    arg > PAGE_SIZE)
+			return -EINVAL;
 		nbd_size_set(nbd, arg,
 			     div_s64(config->bytesize, arg));
 		return 0;

include/linux/blk-cgroup.h+44−1

@@ -56,6 +56,7 @@ struct blkcg { · 55 unmodified lines
56	struct list_head all_blkcgs_node;	56	struct list_head all_blkcgs_node;
57	#ifdef CONFIG_CGROUP_WRITEBACK	57	#ifdef CONFIG_CGROUP_WRITEBACK
58	struct list_head cgwb_list;	58	struct list_head cgwb_list;
		59	refcount_t cgwb_refcnt;
59	#endif	60	#endif
60	};	61	};
61		62
@@ -89,7 +90,6 @@ struct blkg_policy_data { · 27 unmodified lines
89	/* the blkg and policy id this per-policy data belongs to */	90	/* the blkg and policy id this per-policy data belongs to */
90	struct blkcg_gq *blkg;	91	struct blkcg_gq *blkg;
91	int plid;	92	int plid;
92	bool offline;
93	};	93	};
94		94
95	/*	95	/*
@@ -387,6 +387,49 @@ static inline struct blkcg cpd_to_blkcg(struct blkcg_policy_data cpd) · 291 unmodified lines
387	return cpd ? cpd->blkcg : NULL;	387	return cpd ? cpd->blkcg : NULL;
388	}	388	}
389		389
		390	extern void blkcg_destroy_blkgs(struct blkcg *blkcg);
		391
		392	#ifdef CONFIG_CGROUP_WRITEBACK
		393
		394	/**
		395	* blkcg_cgwb_get - get a reference for blkcg->cgwb_list
		396	* @blkcg: blkcg of interest
		397	*
		398	* This is used to track the number of active wb's related to a blkcg.
		399	*/
		400	static inline void blkcg_cgwb_get(struct blkcg *blkcg)
		401	{
		402	refcount_inc(&blkcg->cgwb_refcnt);
		403	}
		404
		405	/**
		406	* blkcg_cgwb_put - put a reference for @blkcg->cgwb_list
		407	* @blkcg: blkcg of interest
		408	*
		409	* This is used to track the number of active wb's related to a blkcg.
		410	* When this count goes to zero, all active wb has finished so the
		411	* blkcg can continue destruction by calling blkcg_destroy_blkgs().
		412	* This work may occur in cgwb_release_workfn() on the cgwb_release
		413	* workqueue.
		414	*/
		415	static inline void blkcg_cgwb_put(struct blkcg *blkcg)
		416	{
		417	if (refcount_dec_and_test(&blkcg->cgwb_refcnt))
		418	blkcg_destroy_blkgs(blkcg);
		419	}
		420
		421	#else
		422
		423	static inline void blkcg_cgwb_get(struct blkcg *blkcg) { }
		424
		425	static inline void blkcg_cgwb_put(struct blkcg *blkcg)
		426	{
		427	/* wb isn't being accounted, so trigger destruction right away */
		428	blkcg_destroy_blkgs(blkcg);
		429	}
		430
		431	#endif
		432
390	/**	433	/**
391	* blkg_path - format cgroup path of blkg	434	* blkg_path - format cgroup path of blkg
392	* @blkg: blkg of interest	435	* @blkg: blkg of interest

mm/backing-dev.c+5−0

 {
 	struct bdi_writeback *wb = container_of(work, struct bdi_writeback,
 						release_work);
+	struct blkcg *blkcg = css_to_blkcg(wb->blkcg_css);
 	mutex_lock(&wb->bdi->cgwb_release_mutex);
 	wb_shutdown(wb);
 	css_put(wb->blkcg_css);
 	mutex_unlock(&wb->bdi->cgwb_release_mutex);
+	/* triggers blkg destruction if cgwb_refcnt becomes zero */
+	blkcg_cgwb_put(blkcg);
 	fprop_local_destroy_percpu(&wb->memcg_completions);
 	percpu_ref_exit(&wb->refcnt);
 	wb_exit(wb);
 			list_add_tail_rcu(&wb->bdi_node, &bdi->wb_list);
 			list_add(&wb->memcg_node, memcg_cgwb_list);
 			list_add(&wb->blkcg_node, blkcg_cgwb_list);
+			blkcg_cgwb_get(blkcg);
 			css_get(memcg_css);
 			css_get(blkcg_css);
 		}