1. Dec 01, 2018
    • Jens Axboe's avatar
      sbitmap: ammortize cost of clearing bits · ea86ea2c
      Jens Axboe authored
      
      
      sbitmap maintains a set of words that we use to set and clear bits, with
      each bit representing a tag for blk-mq. Even though we spread the bits
      out and maintain a hint cache, one particular bit allocated will end up
      being cleared in the exact same spot.
      
      This introduces batched clearing of bits. Instead of clearing a given
      bit, the same bit is set in a cleared/free mask instead. If we fail
      allocating a bit from a given word, then we check the free mask, and
      batch move those cleared bits at that time. This trades 64 atomic bitops
      for 2 cmpxchg().
      
      In a threaded poll test case, half the overhead of getting and clearing
      tags is removed with this change. On another poll test case with a
      single thread, performance is unchanged.
      
      Reviewed-by: default avatarOmar Sandoval <osandov@fb.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      ea86ea2c
  2. Nov 30, 2018
  3. Nov 29, 2018
    • Dan Carpenter's avatar
      blk-mq: Add a NULL check in blk_mq_free_map_and_requests() · 4e6db0f2
      Dan Carpenter authored
      
      
      I recently found some code which called blk_mq_free_map_and_requests()
      with a NULL set->tags pointer.  I fixed the caller, but it seems like a
      good idea to add a NULL check here as well.  Now we can call:
      
      	blk_mq_free_tag_set(set);
      	blk_mq_free_tag_set(set);
      
      twice in a row and it's harmless.
      
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      4e6db0f2
    • Dan Carpenter's avatar
      ataflop: fix error handling in atari_floppy_init() · 49379e6d
      Dan Carpenter authored
      
      
      Smatch complains that there is an off by one if the allocation fails in:
      
      	DMABuffer = atari_stram_alloc(BUFFER_SIZE+512, "ataflop");
      
      In that situation, "i" would be point to one element beyond the end of
      the unit[] array.
      
      There is a second bug because the error handling calls
      blk_mq_free_tag_set(&unit[i].tag_set); regardless of whether
      "disk->queue" is NULL or non-NULL.  So if blk_mq_init_sq_queue() fails,
      then that means unit[i].tag_set->tags is NULL and it leads to an Oops.
      
      It's easiest to call put_disk() before the goto to clean up the partial
      iteration.  Then the earlier unit[] elements are fully allocated so we
      can remove the checks whether "disk->queue" is NULL and the code is
      simpler.
      
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      49379e6d
    • Weiping Zhang's avatar
      block: add io timeout to sysfs · 65cd1d13
      Weiping Zhang authored
      
      
      Give a interface to adjust io timeout(ms) by device.
      
      Signed-off-by: default avatarWeiping Zhang <zhangweiping@didiglobal.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      65cd1d13
    • Yufen Yu's avatar
      block: use rcu_work instead of call_rcu to avoid sleep in softirq · 94a2c3a3
      Yufen Yu authored
      We recently got a stack by syzkaller like this:
      
      BUG: sleeping function called from invalid context at mm/slab.h:361
      in_atomic(): 1, irqs_disabled(): 0, pid: 6644, name: blkid
      INFO: lockdep is turned off.
      CPU: 1 PID: 6644 Comm: blkid Not tainted 4.4.163-514.55.6.9.x86_64+ #76
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
       0000000000000000 5ba6a6b879e50c00 ffff8801f6b07b10 ffffffff81cb2194
       0000000041b58ab3 ffffffff833c7745 ffffffff81cb2080 5ba6a6b879e50c00
       0000000000000000 0000000000000001 0000000000000004 0000000000000000
      Call Trace:
       <IRQ>  [<ffffffff81cb2194>] __dump_stack lib/dump_stack.c:15 [inline]
       <IRQ>  [<ffffffff81cb2194>] dump_stack+0x114/0x1a0 lib/dump_stack.c:51
       [<ffffffff8129a981>] ___might_sleep+0x291/0x490 kernel/sched/core.c:7675
       [<ffffffff8129ac33>] __might_sleep+0xb3/0x270 kernel/sched/core.c:7637
       [<ffffffff81794c13>] slab_pre_alloc_hook mm/slab.h:361 [inline]
       [<ffffffff81794c13>] slab_alloc_node mm/slub.c:2610 [inline]
       [<ffffffff81794c13>] slab_alloc mm/slub.c:2692 [inline]
       [<ffffffff81794c13>] kmem_cache_alloc_trace+0x2c3/0x5c0 mm/slub.c:2709
       [<ffffffff81cbe9a7>] kmalloc include/linux/slab.h:479 [inline]
       [<ffffffff81cbe9a7>] kzalloc include/linux/slab.h:623 [inline]
       [<ffffffff81cbe9a7>] kobject_uevent_env+0x2c7/0x1150 lib/kobject_uevent.c:227
       [<ffffffff81cbf84f>] kobject_uevent+0x1f/0x30 lib/kobject_uevent.c:374
       [<ffffffff81cbb5b9>] kobject_cleanup lib/kobject.c:633 [inline]
       [<ffffffff81cbb5b9>] kobject_release+0x229/0x440 lib/kobject.c:675
       [<ffffffff81cbb0a2>] kref_sub include/linux/kref.h:73 [inline]
       [<ffffffff81cbb0a2>] kref_put include/linux/kref.h:98 [inline]
       [<ffffffff81cbb0a2>] kobject_put+0x72/0xd0 lib/kobject.c:692
       [<ffffffff8216f095>] put_device+0x25/0x30 drivers/base/core.c:1237
       [<ffffffff81c4cc34>] delete_partition_rcu_cb+0x1d4/0x2f0 block/partition-generic.c:232
       [<ffffffff813c08bc>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
       [<ffffffff813c08bc>] rcu_do_batch kernel/rcu/tree.c:2705 [inline]
       [<ffffffff813c08bc>] invoke_rcu_callbacks kernel/rcu/tree.c:2973 [inline]
       [<ffffffff813c08bc>] __rcu_process_callbacks kernel/rcu/tree.c:2940 [inline]
       [<ffffffff813c08bc>] rcu_process_callbacks+0x59c/0x1c70 kernel/rcu/tree.c:2957
       [<ffffffff8120f509>] __do_softirq+0x299/0xe20 kernel/softirq.c:273
       [<ffffffff81210496>] invoke_softirq kernel/softirq.c:350 [inline]
       [<ffffffff81210496>] irq_exit+0x216/0x2c0 kernel/softirq.c:391
       [<ffffffff82c2cd7b>] exiting_irq arch/x86/include/asm/apic.h:652 [inline]
       [<ffffffff82c2cd7b>] smp_apic_timer_interrupt+0x8b/0xc0 arch/x86/kernel/apic/apic.c:926
       [<ffffffff82c2bc25>] apic_timer_interrupt+0xa5/0xb0 arch/x86/entry/entry_64.S:746
       <EOI>  [<ffffffff814cbf40>] ? audit_kill_trees+0x180/0x180
       [<ffffffff8187d2f7>] fd_install+0x57/0x80 fs/file.c:626
       [<ffffffff8180989e>] do_sys_open+0x45e/0x550 fs/open.c:1043
       [<ffffffff818099c2>] SYSC_open fs/open.c:1055 [inline]
       [<ffffffff818099c2>] SyS_open+0x32/0x40 fs/open.c:1050
       [<ffffffff82c299e1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
      
      In softirq context, we call rcu callback function delete_partition_rcu_cb(),
      which may allocate memory by kzalloc with GFP_KERNEL flag. If the
      allocation cannot be satisfied, it may sleep. However, That is not allowed
      in softirq contex.
      
      Although we found this problem on linux 4.4, the latest kernel version
      seems to have this problem as well. And it is very similar to the
      previous one:
      	https://lkml.org/lkml/2018/7/9/391
      
      
      
      Fix it by using RCU workqueue, which allows sleep.
      
      Reviewed-by: default avatarPaul E. McKenney <paulmck@linux.ibm.com>
      Signed-off-by: default avatarYufen Yu <yuyufen@huawei.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      94a2c3a3
  4. Nov 28, 2018
  5. Nov 27, 2018
  6. Nov 26, 2018
  7. Nov 21, 2018
  8. Nov 20, 2018
  9. Nov 19, 2018