1. 12 Jun, 2012 2 commits
    • Lars Ellenberg's avatar
      drbd: fix list corruption by failing but already aborted reads · 1ed25b26
      Lars Ellenberg authored
      If a read is aborted due to force-detach of a supposedly unresponsive
      local backing device, and retried on the peer, it can happen that the
      local request later still completes (hopefully with an error).
      As it may already have been completed to upper layers meanwhile,
      it must not be retried again now.
      Signed-off-by: default avatarPhilipp Reisner <philipp.reisner@linbit.com>
      Signed-off-by: default avatarLars Ellenberg <lars.ellenberg@linbit.com>
      1ed25b26
    • Lars Ellenberg's avatar
      drbd: fix access of unallocated pages and kernel panic · 4eccc579
      Lars Ellenberg authored
      BUG: unable to handle kernel NULL pointer dereference at (null)
      ...
       [<d1e17561>] ? _drbd_bm_set_bits+0x151/0x240 [drbd]
       [<d1e236f8>] ? receive_bitmap+0x4f8/0xbc0 [drbd]
      
      This fixes an off-by-one error in the receive_bitmap() path,
      if run-length encoded bitmap transfer is enabled.
      
      If the bitmap is an exact multiple of PAGE_SIZE, which means the visible
      capacity of the drbd device is an exact multiple of 128 MiB (for 4k page
      size), and bitmap compression (use-rle) is enabled (which became default
      with 8.4), and the very last bit is dirty and reported in an rle
      comressed bitmap packet, we ended up trying to kmap_atomic a page pointer
      that does not exist (bitmap->bm_pages[last index + 1]).
      
      bug introduced by:
          Date:   Fri Jul 24 15:33:24 2009 +0200
          set bits: optimize for complete last word, fix off-by-one-word corner case
      
      made effective by:
          Date:   Thu Dec 16 00:32:38 2010 +0100
          drbd: get rid of unused debug code
      
          Long time ago, we had paranoia code in the bitmap that allocated one
          extra word, assigned a magic value, and checked on every occasion that
          the magic value was still unchanged.
      
          That debug code is unused, the extra long word complicates code a bit.
          Get rid of it.
      
      No-one triggered this bug in the last few years, because a large subset
      of our userbase is unaffected:
       * typically the last few blocks of a device are not modified
         frequently, and remain unset
       * use-rle was disabled by default in drbd < 8.4
       * those with slightly "odd" device sizes, or
       * drbd internal meta data (which will skew the device size slightly,
         thus makes it harder to have a bug relevant device size)
      Signed-off-by: default avatarPhilipp Reisner <philipp.reisner@linbit.com>
      Signed-off-by: default avatarLars Ellenberg <lars.ellenberg@linbit.com>
      4eccc579
  2. 18 May, 2012 5 commits
    • Jens Axboe's avatar
      Merge branch 'for-jens' of git://git.drbd.org/linux-drbd into for-3.5/drivers · 4fd1ffaa
      Jens Axboe authored
      Philipp writes:
      
      This are the updates we have in the drbd-8.3 tree. They are intended
      for your "for-3.5/drivers" drivers branch.
      
      These changes include one new feature:
       * Allow detach from frozen backing devices with the new --force option;
         configurable timeout for backing devices by the new disk-timeout option
      
      And huge number of bug fixes:
       * Fixed a write ordering problem on SyncTarget nodes for a write
         to a block that gets resynced at the same time. The bug can
         only be triggered with a device that has a firmware that
         actually reorders writes to the same block
       * Fixed a race between disconnect and receive_state, that could cause
         a IO lockup
       * Fixed resend/resubmit for requests with disk or network timeout
       * Make sure that hard state changed do not disturb the connection
         establishing process (I.e. detach due to an IO error). When the
         bug was triggered it caused a retry in the connect process
       * Postpone soft state changes to no disturb the connection
         establishing process (I.e. becoming primary). When the bug
         was triggered it could cause both nodes going into SyncSource state
       * Fixed a refcount leak that could cause failures when trying to
         unload a protocol family modules, that was used by DRBD
       * Dedicated page pool for meta data IOs
       * Deny normal detach (as opposed to --forced) if the user tries
         to detach from the last UpToDate disk in the resource
       * Fixed a possible protocol error that could be caused by
         "unusual" BIOs.
       * Enforce the disk-timeout option also on meta-data IO operations
       * Implemented stable bitmap pages when we do a full write out of
         the bitmap
       * Fixed a rare compatibility issue with DRBD's older than 8.3.7
         when negotiating the bio_size
       * Fixed a rare race condition where an empty resync could stall with
         if pause/unpause events happen in parallel
       * Made the re-establishing of connections quicker, if it got a broken pipe
         once. Previously there was a bug in the code caused it to waste the first
         successful established connection after a broken pipe event.
      
      PS: I am postponing the drbd-8.4 for mainline for one or two kernel
          development cycles more (the ~400 patchets set).
      4fd1ffaa
    • Jens Axboe's avatar
      Merge branch 'stable/for-jens-3.5' of... · 13828dec
      Jens Axboe authored
      Merge branch 'stable/for-jens-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen into for-3.5/drivers
      
      Konrad writes:
      
      Please git pull the following branch:
      
       git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen.git stable/for-jens-3.5
      
      in your for-3.5/drivers branch. The changes in it are rather simple - cleaning
      up some code and adding proper mechanism to unload without leaking memory.
      13828dec
    • Jiri Kosina's avatar
      floppy: take over maintainership · 8206f664
      Jiri Kosina authored
      I have fought the current maintainer to the death in the Thunderdome
      [1] https://lkml.org/lkml/2012/5/16/370
      
      Umm, actually, there is noone taking care of the driver due to lack
      of real hardware, and I still have some. The driver exposes bugs on
      emulated/virtualized devices (mostly due to timing), but it's essential
      to verify the fixes against a real hardware as well (which has been
      holding back some of the fixes).
      Acked-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      8206f664
    • Jiri Kosina's avatar
      floppy: remove floppy-specific O_EXCL handling · bfa10b8c
      Jiri Kosina authored
      Block layer now handles O_EXCL in a generic way for block devices.
      
      The semantics is however different for floppy and all other block devices,
      as floppy driver contains its own O_EXCL handling.
      
      The semantics for all-but-floppy bdevs is "there can be at most one O_EXCL
      open of this file", while for floppy bdev the semantics is "if someone has
      the bdev open with O_EXCL, noone else can open it".
      
      There is actual userspace-observable change in behavior because of this
      since commit e525fd89 ("block: make blkdev_get/put() handle exclusive
      access") -- on kernels containing this commit, mount of /dev/fd0 causes
      the fd0 block device be claimed with _EXCL, preventing subsequent
      open(/dev/fd0).
      
      Bring things back into shape, i.e.  make it possible, analogically to
      other block devices, to mount the floppy and open() it afterwards --
      remove the floppy-specific handling and let the generic bdev code O_EXCL
      handling take over.
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Acked-by: default avatarTejun Heo <tj@kernel.org>
      Acked-by: default avatarNeilBrown <neilb@suse.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      bfa10b8c
    • Jiri Kosina's avatar
      floppy: convert to delayed work and single-thread wq · 070ad7e7
      Jiri Kosina authored
      There are several races in floppy driver between bottom half
      (scheduled_work) and timers (fd_timeout, fd_timer). Due to slowness
      of the actual floppy devices, those races are never (at least to my
      knowledge) triggered on a bare floppy metal. However on virtualized
      (emulated) floppy drives, which are of course magnitudes faster
      than the real ones, these races trigger reliably. They usually exhibit
      themselves as NULL pointer dereferences during DMA setup, such as
      
      	BUG: unable to handle kernel NULL pointer dereference at 0000000a
      	[ ... snip ... ]
      	EIP: 0060:[<c02053d5>] EFLAGS: 00010293 CPU: 0
      	EAX: ffffe000 EBX: 0000000a ECX: 00000000 EDX: 0000000a
      	ESI: c05d2718 EDI: 00000000 EBP: 00000000 ESP: f540fe44
      	 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
      	Process swapper (pid: 0, ti=f540e000 task=c082d5a0 task.ti=c0826000)
      	Stack:
      	 ffffe000 00001ffc 00000000 00000000 00000000 c05d2718 c0708b40 f540fe80
      	 c020470f c05d2718 c0708b40 00000000 f540fe80 0000000a f540fee4 00000000
      	 c0708b40 f540fee4 00000000 00000000 c020526b 00000000 c05d2718 c0708b40
      	Call Trace:
      	 [<c020470f>] dump_trace+0xaf/0x110
      	 [<c020526b>] show_trace_log_lvl+0x4b/0x60
      	 [<c0205298>] show_trace+0x18/0x20
      	 [<c05c5811>] dump_stack+0x6d/0x72
      	 [<c0248527>] warn_slowpath_common+0x77/0xb0
      	 [<c02485f3>] warn_slowpath_fmt+0x33/0x40
      	 [<f7ec593c>] setup_DMA+0x14c/0x210 [floppy]
      	 [<f7ecaa95>] setup_rw_floppy+0x105/0x190 [floppy]
      	 [<c0256d08>] run_timer_softirq+0x168/0x2a0
      	 [<c024e762>] __do_softirq+0xc2/0x1c0
      	 [<c02042ed>] do_softirq+0x7d/0xb0
      	 [<f54d8a00>] 0xf54d89ff
      
      but other instances can be easily seen as well. This can be observed at least under
      VMWare, VirtualBox and KVM.
      
      This patch converts all the timers and bottom halfs to be processed in a single
      workqueue. This aproach has been already discussed back in 2010 if I remember
      correctly, and Acked by Linus [1], but it then never made it to the tree.
      
      This all is based on original idea and code of Stephen Hemminger.  I have
      ported original Stepen's code to the current state of the floppy driver, and
      performed quite some testing (on real hardware), which didn't reveal any issues
      (this includes not only writing and reading data, but also formatting
      (unfortunately I didn't find any Double-Density disks any more)). Ability to
      handle errors properly (supplying known bad floppies) has also been verified.
      
      [1] http://kerneltrap.org/mailarchive/linux-kernel/2010/6/11/4582092Based-on-patch-by: default avatarStephen Hemminger <shemminger@vyatta.com>
      Acked-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      070ad7e7
  3. 11 May, 2012 2 commits
  4. 10 May, 2012 2 commits
  5. 09 May, 2012 29 commits