Skip to content

L
linux
Switch branch/tag
  1. 20 Oct, 2007 8 commits
    • Jun'ichi Nomura's avatar
      dm: fix thaw_bdev · ae9da83f
      Jun'ichi Nomura authored 
      This patch fixes a bd_mount_sem counter corruption bug in device-mapper.

thaw_bdev() should be called only when freeze_bdev() was called for the
device.
Otherwise, thaw_bdev() will up bd_mount_sem and corrupt the semaphore counter.
struct block_device with the corrupted semaphore may remain in slab cache
and be reused later.

Attached patch will fix it by calling unlock_fs() instead.
unlock_fs() will determine whether it should call thaw_bdev()
by checking the device is frozen or not.

Easy reproducer is:
  #!/bin/sh
  while [ 1 ]; do
     dmsetup --notable create a
     dmsetup --nolockfs suspend a
     dmsetup remove a
  done

It's not easy to see the effect of corrupted semaphore.
So I have tested with putting printk below in bdev_alloc_inode():
        if (atomic_read(&ei->bdev.bd_mount_sem.count) != 1)
                printk(KERN_DEBUG "Incorrect semaphore count = %d (%p)\n",
                        atomic_read(&ei->bdev.bd_mount_sem.count),
                        &ei->bdev);

Without the patch, I saw something like:
 Incorrect semaphore count = 17 (f2ab91c0)

With the patch, the message didn't appear.

The bug was introduced in 2.6.16 with this bug fix:

commit d9dde59b
Date:   Fri Feb 24 13:04:24 2006 -0800

    [PATCH] dm: missing bdput/thaw_bdev at removal

    Need to unfreeze and release bdev otherwise the bdev inode with
    inconsistent state is reused later and cause problem.

and backported to 2.6.15.5.

It occurs only in free_dev(), which is called only when the dm device is
removed.  The buggy code is executed only if md->suspended_bdev is
non-NULL and that can happen only when the device was suspended without
noflush.
Signed-off-by: default avatarJun'ichi Nomura <j-nomura@ce.jp.nec.com>
Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
Cc: stable@kernel.org
      ae9da83f
    • Milan Broz's avatar
      dm delay: fix status · 79662d1e
      Milan Broz authored 
      Fix missing space in dm-delay target status output
if separate read and write delay are configured.
Signed-off-by: default avatarMilan Broz <mbroz@redhat.com>
Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      79662d1e
    • Dmitry Monakhov's avatar
      dm delay: fix ctr error paths · 2e64a0f9
      Dmitry Monakhov authored 
      Add missing 'dm_put_device' to dm-delay target constructor.
Signed-off-by: default avatarDmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: default avatarMilan Broz <mbroz@redhat.com>
Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      2e64a0f9
    • Dmitry Monakhov's avatar
      dm raid1: fix leakage · a72cf737
      Dmitry Monakhov authored 
      Add missing 'dm_io_client_destroy' to alloc_context error path.
Reorganize mirror constructor error path in order to prevent
workqueue leakage.
Signed-off-by: default avatarDmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      a72cf737
    • Dmitry Monakhov's avatar
      dm crypt: missing kfree in ctr error path · 815f9e32
      Dmitry Monakhov authored 
      Insert missing kfree() in crypt_iv_essiv_ctr() error path.
Signed-off-by: default avatarDmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      815f9e32
    • Dmitry Monakhov's avatar
      dm crypt: drop device ref in ctr error path · 55b42c5a
      Dmitry Monakhov authored 
      Add a missing 'dm_put_device' in an error path in crypt target constructor.
Signed-off-by: default avatarDmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: default avatarMilan Broz <mbroz@redhat.com>
Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      55b42c5a
    • Milan Broz's avatar
      dm io:ctl use constant struct size · 027d50f9
      Milan Broz authored 
      Make size of dm_ioctl struct always 312 bytes on all supported
architectures.

This change retains compatibility with already-compiled code because
it uses an embedded offset to locate the payload that follows the
structure.

On 64-bit architectures there is no change at all; on 32-bit
we are increasing the size of dm-ioctl from 308 to 312 bytes.

Currently with 32-bit userspace / 64-bit kernel on x86_64
some ioctls (including rename, message) are incorrectly rejected
by the comparison against 'param + 1'.  This breaks userspace
lvrename and multipath 'fail_if_no_path' changes, for example.

(BTW Device-mapper uses its own versioning and ignores the ioctl
size bits.  Only the generic ioctl compat code on mixed arches
checks them, and that will continue to accept both sizes for now,
but we intend to list 308 as deprecated and eventually remove it.)
Signed-off-by: default avatarMilan Broz <mbroz@redhat.com>
Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
Cc: Guido Guenther <agx@sigxcpu.org>
Cc: Kevin Corry <kevcorry@us.ibm.com>
Cc: stable@kernel.org
      027d50f9
    • Bryn M. Reeves's avatar
      dm mpath: rdac fix init race · c7ac86de
      Bryn M. Reeves authored 
      Re-order the initialisation of dm-rdac to avoid registering the hw
handler before the workqueue has been initialised. Closes a race
that would potentially give an oops.
Signed-off-by: default avatarBryn M. Reeves <breeves@redhat.com>
Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      c7ac86de
  3. 19 Oct, 2007 32 commits
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7