[lvc-project] [PATCH 5.10] dm: fix unconditional IO throttle caused by REQ_PREFLUSH

[Fedor Pchelkin]

On Fri, 27. Feb 14:15, Viktoriya Danchenko wrote:
> From: Victoria Danchenko <v.danchenko at omp.ru>

Эта строчка по-прежнему в патче.  Уберу вручную при применении, но прошу
разобраться с этой ситуацией, чтобы она вновь не повторялась в будущих
патчах.  Как писал в прошлом письме, возможно информация в конфиг. файле
~/.gitconfig не соответствует действительности, и поэтому git send-email
автоматически эту строчку вставляет.  Также у git send-email можете
изучить опции вызова, которые на это позволяют влиять.

> 
> From: Jinliang Zheng <alexjlzheng at gmail.com>
> 
> commit 88f7f56d16f568f19e1a695af34a7f4a6ce537a6 upstream.
> 
> When a bio with REQ_PREFLUSH is submitted to dm, __send_empty_flush()
> generates a flush_bio with REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC,
> which causes the flush_bio to be throttled by wbt_wait().
> 
> An example from v5.4, similar problem also exists in upstream:
> 
>     crash> bt 2091206
>     PID: 2091206  TASK: ffff2050df92a300  CPU: 109  COMMAND: "kworker/u260:0"
>      #0 [ffff800084a2f7f0] __switch_to at ffff80004008aeb8
>      #1 [ffff800084a2f820] __schedule at ffff800040bfa0c4
>      #2 [ffff800084a2f880] schedule at ffff800040bfa4b4
>      #3 [ffff800084a2f8a0] io_schedule at ffff800040bfa9c4
>      #4 [ffff800084a2f8c0] rq_qos_wait at ffff8000405925bc
>      #5 [ffff800084a2f940] wbt_wait at ffff8000405bb3a0
>      #6 [ffff800084a2f9a0] __rq_qos_throttle at ffff800040592254
>      #7 [ffff800084a2f9c0] blk_mq_make_request at ffff80004057cf38
>      #8 [ffff800084a2fa60] generic_make_request at ffff800040570138
>      #9 [ffff800084a2fae0] submit_bio at ffff8000405703b4
>     #10 [ffff800084a2fb50] xlog_write_iclog at ffff800001280834 [xfs]
>     #11 [ffff800084a2fbb0] xlog_sync at ffff800001280c3c [xfs]
>     #12 [ffff800084a2fbf0] xlog_state_release_iclog at ffff800001280df4 [xfs]
>     #13 [ffff800084a2fc10] xlog_write at ffff80000128203c [xfs]
>     #14 [ffff800084a2fcd0] xlog_cil_push at ffff8000012846dc [xfs]
>     #15 [ffff800084a2fda0] xlog_cil_push_work at ffff800001284a2c [xfs]
>     #16 [ffff800084a2fdb0] process_one_work at ffff800040111d08
>     #17 [ffff800084a2fe00] worker_thread at ffff8000401121cc
>     #18 [ffff800084a2fe70] kthread at ffff800040118de4
> 
> After commit 2def2845cc33 ("xfs: don't allow log IO to be throttled"),
> the metadata submitted by xlog_write_iclog() should not be throttled.
> But due to the existence of the dm layer, throttling flush_bio indirectly
> causes the metadata bio to be throttled.
> 
> Fix this by conditionally adding REQ_IDLE to flush_bio.bi_opf, which makes
> wbt_should_throttle() return false to avoid wbt_wait().
> 
> Signed-off-by: Jinliang Zheng <alexjlzheng at tencent.com>
> Reviewed-by: Tianxiang Peng <txpeng at tencent.com>
> Reviewed-by: Hao Peng <flyingpeng at tencent.com>
> Signed-off-by: Mikulas Patocka <mpatocka at redhat.com>
> Signed-off-by: Sasha Levin <sashal at kernel.org>
> Signed-off-by: Andrey Algin <a.algin at omp.ru>
> Fixes: dbe3ece1287d ("dm: don't reuse bio for flushes")
> Signed-off-by: Victoria Danchenko <v.danchenko at omp.ru>
> ---
> Backport fix for CVE-2025-38063
> ---
>  drivers/md/dm.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/md/dm.c b/drivers/md/dm.c
> index b51281ce15d4..d63522c0ba08 100644
> --- a/drivers/md/dm.c
> +++ b/drivers/md/dm.c
> @@ -1427,6 +1427,11 @@ static int __send_empty_flush(struct clone_info *ci)
>  	unsigned target_nr = 0;
>  	struct dm_target *ti;
>  	struct bio flush_bio;
> +	unsigned int opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC;
> +
> +	if ((ci->io->orig_bio->bi_opf & (REQ_IDLE | REQ_SYNC)) ==
> +	    (REQ_IDLE | REQ_SYNC))
> +		opf |= REQ_IDLE;
>  
>  	/*
>  	 * Use an on-stack bio for this, it's safe since we don't
> @@ -1434,7 +1439,7 @@ static int __send_empty_flush(struct clone_info *ci)
>  	 * the basis for the clone(s).
>  	 */
>  	bio_init(&flush_bio, NULL, 0);
> -	flush_bio.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC;
> +	flush_bio.bi_opf = opf;
>  	ci->bio = &flush_bio;
>  	ci->sector_count = 0;
>  
> -- 
> 2.43.0