ACK: [PATCH 1/1] btrfs: raid56: properly unmap parity page in finish_parity_scrub()

[Kleber Souza]

On 3/28/19 6:09 PM, Andrea Righi wrote:
> Buglink: https://bugs.launchpad.net/bugs/1812845
> 
> Parity page is incorrectly unmapped in finish_parity_scrub(), triggering
> a reference counter bug on i386, i.e.:
> 
>  [ 157.662401] kernel BUG at mm/highmem.c:349!
>  [ 157.666725] invalid opcode: 0000 [#1] SMP PTI
> 
> The reason is that kunmap(p_page) was completely left out, so we never
> did an unmap for the p_page and the loop unmapping the rbio page was
> iterating over the wrong number of stripes: unmapping should be done
> with nr_data instead of rbio->real_stripes.
> 
> Test case to reproduce the bug:
> 
>  - create a raid5 btrfs filesystem:
>    # mkfs.btrfs -m raid5 -d raid5 /dev/sdb /dev/sdc /dev/sdd /dev/sde
> 
>  - mount it:
>    # mount /dev/sdb /mnt
> 
>  - run btrfs scrub in a loop:
>    # while :; do btrfs scrub start -BR /mnt; done
> 
> BugLink: https://bugs.launchpad.net/bugs/1812845
> Fixes: 5a6ac9eacb49 ("Btrfs, raid56: support parity scrub on raid56")
> CC: stable at vger.kernel.org # 4.4+
> Reviewed-by: Johannes Thumshirn <jthumshirn at suse.de>
> Signed-off-by: Andrea Righi <andrea.righi at canonical.com>
> Reviewed-by: David Sterba <dsterba at suse.com>
> Signed-off-by: David Sterba <dsterba at suse.com>
> (cherry picked from commit 3897b6f0a859288c22fb793fad11ec2327e60fcd)
> Signed-off-by: Andrea Righi <andrea.righi at canonical.com>

Acked-by: Kleber Sacilotto de Souza <kleber.souza at canonical.com>

> ---
>  fs/btrfs/raid56.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
> index 5e4ad134b9ad..c21fc4601562 100644
> --- a/fs/btrfs/raid56.c
> +++ b/fs/btrfs/raid56.c
> @@ -2462,8 +2462,9 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio,
>  			bitmap_clear(rbio->dbitmap, pagenr, 1);
>  		kunmap(p);
>  
> -		for (stripe = 0; stripe < rbio->real_stripes; stripe++)
> +		for (stripe = 0; stripe < nr_data; stripe++)
>  			kunmap(page_in_rbio(rbio, stripe, pagenr, 0));
> +		kunmap(p_page);
>  	}
>  
>  	__free_page(p_page);
>