From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 4606380E7E for ; Tue, 3 Nov 2026 10:12:50 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A3ABWQg003937; Tue, 3 Nov 2026 13:11:33 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A3ABWQg003937 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="VPqdZvY3" Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A3ABAPX003885 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 3 Nov 2026 13:11:11 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A3ABAPX003885 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-48e0461e040so3339712f8f.0 for ; Tue, 03 Nov 2026 02:11:10 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBwZeRZVmMitzkF5Qie2HQTp4tMWgMleQEk/i1b9puFJYYrkpvsZSw+9NyIHA4J+O1wj72TikQ==@openvz.org X-Gm-Message-State: APuU4Z8msUrENJkBWj+OtAEoboYcPtirAqzkr6QNYdvBmcPHaP9obxOg qVS53qxj6pC1VkP+WJPif/5Ylt2K0FxjhKDlOOz754hsxa4LuGzr/B/3LZpBrxogwuopfScmrxX lkyU83Q2AqAdroo5/SUQF1TAEZU1VcO5oDifMUw+bfcKsOD22fETOAQ== X-Gm-Gg: AYBFou1VLpwYQiGk/FhMxy900Qz9OiMo4rBThQFziOzghp1oXDHAv5Y9SYzUPMJU8uR wQHZ/RfFXDXAUk+d7W6N7kXKBnd05Xew0w5u3BHkMYmlR9Qd/4oqKq6t1OlqAicFI5QY8J+7xNT HF5+TanSTlYOLvqFnuhdSzXAkOeX0oPM0GHC/0pE3vRPJOaZZCzAJt5PXaXbmVySuxIzzIKHMqB Cn0bXdF8k6gOw4Qd03zv6dCaImkmwSWUxHu86nlG6bfZovpdtYcXSfuZHLjzVtrDN9+dQ7fkIc7 pr5clBlCn15gGEax2yECU3gNhfqnbB1m8kO5aoT4ORG1Wp+kDJmJcypt8JS3ptttrgrQrlSxy3v l7PeBpEq6A/O/JO9e X-Received: by 2002:a05:6000:2387:b0:48e:861b:882a with SMTP id ffacd0b85a97d-48e861b88abmr9041738f8f.47.1793700670218; Tue, 03 Nov 2026 02:11:10 -0800 (PST) X-Received: by 2002:a05:6000:2387:b0:48e:861b:882a with SMTP id ffacd0b85a97d-48e861b88abmr9041678f8f.47.1793700669652; Tue, 03 Nov 2026 02:11:09 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793700669; cv=none; d=google.com; s=arc-20260327; b=XYQpAS20R3k+zGPaGMAaX7pl/vVkFrxCR4dsgAMet21qsLX8qKZHmZhVqnFYmTMi/t qlHfXNfPruf8qBOgJjRW3CKwcKr8/Dld+agfsxf1cyW2csZhsVTztyVTNX/CrwbNEII0 8O0ZrvdkFSmfMn81A0Jmf1psCgXLzvFygUDc7sN7WrLfeHY1+KLYRBYxwNFeemfj6Pd/ bWUhCZ9j7BLNROq47im2Yv2B4G9jbTPVjiundbtIVu5wFlk1ox2dyNhlUYHKMjMb5Jzk Uj4epGj9fxM3HnRmvIcEakMqa1xJiziCVwR+lqfo5kqWlM+uic9o4AtpWHs3KFvQmwvK wUmw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=message-id:date:references:in-reply-to:cc:to:from:subject :content-transfer-encoding:mime-version:dkim-signature; bh=hJsEN6/TeHzkh2rVQxaYJZ+f3KQOg9kni4m337Cqpyc=; fh=NNIHAR0oQq9xcHtG6fvuNrouibWQy9PtHjAIRR7/XzE=; b=OdXvBnHCgzS7PQX8LEgiKVJQTSP3voj6tzpYfSlvsBodIv9BtCqGkEpHVAYOL3D3ax d/fMSQi3ay5Dk52tsQbGgo2wLfW9Fho6BDANmAwMY2XPWU7GVX2QNaJYoFBKE48joRNQ Ypd4/DcQKr1tTokKwy4/DDJahqiuTYoXAN8W34GDJjnc95h6FRjtBD5dUBxb7j0AsZhx +SBJ5vRQ6e+WqXhJHZEBj5/BaIy7eRTsWEPF+AIWk89a/CbeEJ3w4tTSjyX8WqEhHYT2 3EWGPcg8grDlzCeJNV/Mxys1P7/1p3hyNLWReFGDN00thKr9BJjTxPeJWj/pDrP1Tsx9 It1A==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=VPqdZvY3; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48e7508be00si20337361f8f.386.2026.11.03.02.11.09 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Nov 2026 02:11:09 -0800 (PST) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=VPqdZvY3; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Date:From:Subject:Content-Type: MIME-Version; bh=hJsEN6/TeHzkh2rVQxaYJZ+f3KQOg9kni4m337Cqpyc=; b=VPqdZvY3vbfr X3NMHerHDXbPouoZnwVgEJRQPoQ+drXZNDDho+vcyJzACc5RLz6hFfdxWeYJrSX0RIuT9/3g+M20Z l98SEXxnoVHhIx7C8GymGrmE+mbr3swlXhLUrXFi0cbAhrgTonjlDMjtBbIHh/wRGovfHFENLwWZj IsKmCrI8dlqgzvMBLEUqp9moKRMYbNciTVDGLGLY+qHulA/HouaZCfp2cZUpXaRX3Yic63rT5W7QU f4SbmeVhlz07h4NqOD4dV3BeuzJwVnCO+SNPRiD+6P22B6hrsGA45mdKa+EItlolpfPKzEDZoWDrI /jg+HLiRXGTk6Izwnu27CQ==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xOBQ2-00BKVK-10; Tue, 03 Nov 2026 11:10:59 +0100 MIME-Version: 1.0 From: Konstantin Khorenko To: Andrey Zhadchenko In-Reply-To: <20261103080358.723186-6-andrey.zhadchenko@virtuozzo.com> References: <20261103080358.723186-1-andrey.zhadchenko@virtuozzo.com> <20261103080358.723186-6-andrey.zhadchenko@virtuozzo.com> Date: Tue, 03 Nov 2026 11:11:03 +0100 Message-Id: <179370066312.2382033.8474782518776715664.b4-review@b4> X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3393; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=lw5kSGNXuRm1f5W9QmJV2+YzTG0ZhPxELj51dKm7ixY=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBq6bM6zxlragsTUfBbDhEPRAIcaf5JZSegG63Q/ Na2zLp3i82JAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCaumzOgAKCRBRlgpH+WFc KuqOD/9dglpQm62x/JHkx+oGNymfKa3XnOxroygsFAbn5o8GJqwuTLfNaXOQKKoAmrXkDqfpso0 1GHOD16dZzwLFEOtQs0YtUabIUa4J/jJq6Z+E21zPWMbjYRfyVUQK81VkvWvTGm0cNW+J8QwKL2 FVR9zy2IC0ZQ68KNAQIOMp41HgfSEJdIe/5SKLdd3Y46N5FXUAO354QCXqt3TygOcu75aVBEyo0 CDNDPBK3Nu7z44AZS7/hKrE5SmZJNglWj+DF5vagVxJ8epIzF8VZMCUXg2eBJzOdZ3B10bHB1xj ZmVxtVT8hRvdXz1XLSYQNFGvnuvADGnFHhqUExo4WCpZKCPSPj5HmoSw0dwBL03G8ej4Fk3pPsN YRYPIrg/gSXKa3XDlRK4oY3s/+LzE3Ajf/ceFuNyPGixuWD0NJy9aV4Y+m8igo+hvIOsWUzQbZu V3HVykzqAOpXFzjrpQjKjq6wx3pSspiDsK9MzM73VsNaCPGzaGcSbnbBEzYazGSe/gYYqsHDpOQ p7GylyNxb+Iy3rrweHzD+kaWbBBVntxTgOAQ3V5PnfOxCEeBClLO4u6ogGkgo6Hf1AwWJUm018W 4IL9vH/z/c8jTxPzSsB5Mqd2ZjRCwutAx6rgGZj6ERHdWwilZTohvsXjtRIzWY7kxZqXqpkv/jT elIJOAl3Nf7BN+A== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: Re: [Devel] [PATCH hci-8.1 v4 5/6] drivers/md/push_backup: arm deadline timer under pb->lock X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org On 11/3/26 11:03, Andrey Zhadchenko wrote: > When push_backup_write acks last delayed request it sets > deadline_jiffies = S64_MAX and the next fired timer uses this > for mod_timer(): expiry is set to some very distant future. > > Previously a later push_backup_write() would accidentally > repair the expiry; since it no longer touches the timer, nothing > does until stop. Hi Andrey, When the callback parks the timer this way, nothing is delayed, and the next delayed write takes the nr_delayed == 1 branch in postpone_if_required_for_backup(), which arms the timer itself. So this case is harmless and "nothing does until stop" does not hold. The real bug is the race item 5 of your cover letter describes: the callback reads S64_MAX under the lock, postpone arms a fresh deadline, and the late mod_timer() of the callback overwrites it while writes are delayed. Could these two paragraphs describe that instead? > A callback blocked on pb->lock could thus outlive stop and re-arm the > timer or queue do_pb_work() after flush_workqueue(), expiring a later > session. A small precision: synchronize_rcu() already waited for a callback that was running, or spinning on pb->lock, when it started, because the timer softirq is an RCU reader. What escaped is a firing that starts after the grace period. > @@ -241,23 +241,24 @@ static void pb_timer_func(struct timer_list *timer) > > spin_lock_irqsave(&pb->lock, flags); > deadline = pb->deadline_jiffies; > - spin_unlock_irqrestore(&pb->lock, flags); > - > + if (!pb->alive || deadline == S64_MAX) > + goto unlock; pb->alive is not cleared by cleanup_backup() only. pb_message() clears it for "push_backup_stop" before it takes ctl_rwsem, on purpose since 6cd7e75f682f ("dm/push_backup: Allow to stop push_backup at any time"): spin_lock_irq(&pb->lock); pb->alive = false; spin_unlock_irq(&pb->lock); ... ret = down_write_killable(&pb->ctl_rwsem); ... if (unlikely(ret)) goto out; If the stopping tool gets a fatal signal while the rwsem is held by another message, push_backup_stop() never runs. alive is false, nr_delayed is non-zero and the deadline is real. Before this patch the timer still expired it and do_pb_work() released the guest writes. With this hunk the callback returns and does not re-arm, read() and write() on the fd return -ESTALE, and the writes hang until somebody sends "push_backup_stop" again. dm suspend, "@stats_create" and remove wait for them meanwhile. Checking nr_delayed instead keeps what the patch relies on: if (!pb->nr_delayed) goto unlock; cleanup_backup() zeroes nr_delayed under the same lock hold that clears alive, and postpone only delays while alive. So after stop the callback still neither re-arms nor queues work, and in the state above it expires the deadline as before. While alive, deadline == S64_MAX is the same as nr_delayed == 0. > - WARN_ON_ONCE(timer_delete_sync_try(&pb->deadline_timer) < 0); > + timer_shutdown_sync(&pb->deadline_timer); This also fixes a use-after-free: removing the target while the callback ran made pb_destroy() WARN and go on to destroy_workqueue() and kfree(pb) under it. Both that and the stop race came with the driver, so please add: Fixes: 62e07487348e ("dm: Add push backup driver") -- Konstantin Khorenko, Virtuozzo Linux Kernel Team _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel