diff for duplicates of <20150323224012.GA29505@redhat.com> diff --git a/a/1.txt b/N1/1.txt index aeb3bee..4c6acb4 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -32,7 +32,7 @@ Mike Snitzer <snitzer@redhat.com> wrote: FYI, here is the DM fix I've staged for 4.0-rc6. I'll continue testing the various DM targets before requesting Linus to pull. -From 63a4f065ece613b6d575b538234375b0e9c23bbc Mon Sep 17 00:00:00 2001 +>From 63a4f065ece613b6d575b538234375b0e9c23bbc Mon Sep 17 00:00:00 2001 From: Mike Snitzer <snitzer@redhat.com> Date: Mon, 23 Mar 2015 17:01:43 -0400 Subject: [PATCH] dm: fix add_disk() NULL pointer due to race with free_dev() diff --git a/a/content_digest b/N1/content_digest index f644123..b893457 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -5,16 +5,16 @@ "Subject\0Re: [PATCH 11/12] fs: don't reassign dirty inodes to default_backing_dev_info\0" "Date\0Mon, 23 Mar 2015 18:40:13 -0400\0" "To\0Christoph Hellwig <hch@lst.de>\0" - "Cc\0David Howells <dhowells@redhat.com>" + "Cc\0Jens Axboe <axboe@fb.com>" linux-nfs@vger.kernel.org + Jeff Moyer <jmoyer@redhat.com> + David Howells <dhowells@redhat.com> linux-mm@kvack.org - Jens Axboe <axboe@fb.com> - linux-fsdevel <linux-fsdevel@vger.kernel.org> device-mapper development <dm-devel@redhat.com> linux-mtd@lists.infradead.org + linux-fsdevel <linux-fsdevel@vger.kernel.org> Tejun Heo <tj@kernel.org> - ceph-devel@vger.kernel.org - " Jeff Moyer <jmoyer@redhat.com>\0" + " ceph-devel@vger.kernel.org\0" "\00:1\0" "b\0" "On Sat, Mar 21 2015 at 11:11am -0400,\n" @@ -51,7 +51,7 @@ "FYI, here is the DM fix I've staged for 4.0-rc6. I'll continue testing\n" "the various DM targets before requesting Linus to pull.\n" "\n" - "From 63a4f065ece613b6d575b538234375b0e9c23bbc Mon Sep 17 00:00:00 2001\n" + ">From 63a4f065ece613b6d575b538234375b0e9c23bbc Mon Sep 17 00:00:00 2001\n" "From: Mike Snitzer <snitzer@redhat.com>\n" "Date: Mon, 23 Mar 2015 17:01:43 -0400\n" "Subject: [PATCH] dm: fix add_disk() NULL pointer due to race with free_dev()\n" @@ -164,4 +164,4 @@ "-- \n" 1.7.4.4 -311816cc48e8878af81968a575c3cbb2f6efc83da0e1f044a7fb749f9e1bc4e6 +f0ff3633c731243eb067c67d944e25098b2019fdcebbedcc6aeebf92e8e1bc09
diff --git a/a/1.txt b/N2/1.txt index aeb3bee..a2c4dc7 100644 --- a/a/1.txt +++ b/N2/1.txt @@ -31,116 +31,3 @@ Mike Snitzer <snitzer@redhat.com> wrote: FYI, here is the DM fix I've staged for 4.0-rc6. I'll continue testing the various DM targets before requesting Linus to pull. - -From 63a4f065ece613b6d575b538234375b0e9c23bbc Mon Sep 17 00:00:00 2001 -From: Mike Snitzer <snitzer@redhat.com> -Date: Mon, 23 Mar 2015 17:01:43 -0400 -Subject: [PATCH] dm: fix add_disk() NULL pointer due to race with free_dev() - -Commit c4db59d31e39 ("fs: don't reassign dirty inodes to -default_backing_dev_info") exposed DM to a latent race in free_dev() vs -add_disk() in relation to management of the device's minor number. - -Fix this by refactoring free_dev() to match cleanup order of the -alloc_dev() error path. Move cleanup of the gendisk, queue, and bdev -to _before_ the cleanup of the idr managed minor number. - -Also, purely due to cleanup that fell out during the free_dev() audit: -- adjust dm_blk_close() to access the gendisk's private_data under - the _minor_lock spinlock. -- move __dm_destroy()'s dm_get_live_table() call out from under the - _minor_lock spinlock. - -Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1202449 - -Reported-by: Zdenek Kabelac <zkabelac@redhat.com> -Reported-by: Jeff Moyer <jmoyer@redhat.com> -Signed-off-by: Mike Snitzer <snitzer@redhat.com> ---- - drivers/md/dm.c | 26 ++++++++++++++++---------- - 1 files changed, 16 insertions(+), 10 deletions(-) - -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 9b641b3..8001fe9 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -433,7 +433,6 @@ static int dm_blk_open(struct block_device *bdev, fmode_t mode) - - dm_get(md); - atomic_inc(&md->open_count); -- - out: - spin_unlock(&_minor_lock); - -@@ -442,16 +441,20 @@ out: - - static void dm_blk_close(struct gendisk *disk, fmode_t mode) - { -- struct mapped_device *md = disk->private_data; -+ struct mapped_device *md; - - spin_lock(&_minor_lock); - -+ md = disk->private_data; -+ if (WARN_ON(!md)) -+ goto out; -+ - if (atomic_dec_and_test(&md->open_count) && - (test_bit(DMF_DEFERRED_REMOVE, &md->flags))) - queue_work(deferred_remove_workqueue, &deferred_remove_work); - - dm_put(md); -- -+out: - spin_unlock(&_minor_lock); - } - -@@ -2241,7 +2244,6 @@ static void free_dev(struct mapped_device *md) - int minor = MINOR(disk_devt(md->disk)); - - unlock_fs(md); -- bdput(md->bdev); - destroy_workqueue(md->wq); - - if (md->kworker_task) -@@ -2252,19 +2254,22 @@ static void free_dev(struct mapped_device *md) - mempool_destroy(md->rq_pool); - if (md->bs) - bioset_free(md->bs); -- blk_integrity_unregister(md->disk); -- del_gendisk(md->disk); -+ - cleanup_srcu_struct(&md->io_barrier); - free_table_devices(&md->table_devices); -- free_minor(minor); -+ dm_stats_cleanup(&md->stats); - - spin_lock(&_minor_lock); - md->disk->private_data = NULL; - spin_unlock(&_minor_lock); -- -+ if (blk_get_integrity(md->disk)) -+ blk_integrity_unregister(md->disk); -+ del_gendisk(md->disk); - put_disk(md->disk); - blk_cleanup_queue(md->queue); -- dm_stats_cleanup(&md->stats); -+ bdput(md->bdev); -+ free_minor(minor); -+ - module_put(THIS_MODULE); - kfree(md); - } -@@ -2642,8 +2647,9 @@ static void __dm_destroy(struct mapped_device *md, bool wait) - - might_sleep(); - -- spin_lock(&_minor_lock); - map = dm_get_live_table(md, &srcu_idx); -+ -+ spin_lock(&_minor_lock); - idr_replace(&_minor_idr, MINOR_ALLOCED, MINOR(disk_devt(dm_disk(md)))); - set_bit(DMF_FREEING, &md->flags); - spin_unlock(&_minor_lock); --- -1.7.4.4 diff --git a/a/content_digest b/N2/content_digest index f644123..1840164 100644 --- a/a/content_digest +++ b/N2/content_digest @@ -49,119 +49,6 @@ "> since this appears to be a 4.0-rcX regression.\n" "\n" "FYI, here is the DM fix I've staged for 4.0-rc6. I'll continue testing\n" - "the various DM targets before requesting Linus to pull.\n" - "\n" - "From 63a4f065ece613b6d575b538234375b0e9c23bbc Mon Sep 17 00:00:00 2001\n" - "From: Mike Snitzer <snitzer@redhat.com>\n" - "Date: Mon, 23 Mar 2015 17:01:43 -0400\n" - "Subject: [PATCH] dm: fix add_disk() NULL pointer due to race with free_dev()\n" - "\n" - "Commit c4db59d31e39 (\"fs: don't reassign dirty inodes to\n" - "default_backing_dev_info\") exposed DM to a latent race in free_dev() vs\n" - "add_disk() in relation to management of the device's minor number.\n" - "\n" - "Fix this by refactoring free_dev() to match cleanup order of the\n" - "alloc_dev() error path. Move cleanup of the gendisk, queue, and bdev\n" - "to _before_ the cleanup of the idr managed minor number.\n" - "\n" - "Also, purely due to cleanup that fell out during the free_dev() audit:\n" - "- adjust dm_blk_close() to access the gendisk's private_data under\n" - " the _minor_lock spinlock.\n" - "- move __dm_destroy()'s dm_get_live_table() call out from under the\n" - " _minor_lock spinlock.\n" - "\n" - "Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1202449\n" - "\n" - "Reported-by: Zdenek Kabelac <zkabelac@redhat.com>\n" - "Reported-by: Jeff Moyer <jmoyer@redhat.com>\n" - "Signed-off-by: Mike Snitzer <snitzer@redhat.com>\n" - "---\n" - " drivers/md/dm.c | 26 ++++++++++++++++----------\n" - " 1 files changed, 16 insertions(+), 10 deletions(-)\n" - "\n" - "diff --git a/drivers/md/dm.c b/drivers/md/dm.c\n" - "index 9b641b3..8001fe9 100644\n" - "--- a/drivers/md/dm.c\n" - "+++ b/drivers/md/dm.c\n" - "@@ -433,7 +433,6 @@ static int dm_blk_open(struct block_device *bdev, fmode_t mode)\n" - " \n" - " \tdm_get(md);\n" - " \tatomic_inc(&md->open_count);\n" - "-\n" - " out:\n" - " \tspin_unlock(&_minor_lock);\n" - " \n" - "@@ -442,16 +441,20 @@ out:\n" - " \n" - " static void dm_blk_close(struct gendisk *disk, fmode_t mode)\n" - " {\n" - "-\tstruct mapped_device *md = disk->private_data;\n" - "+\tstruct mapped_device *md;\n" - " \n" - " \tspin_lock(&_minor_lock);\n" - " \n" - "+\tmd = disk->private_data;\n" - "+\tif (WARN_ON(!md))\n" - "+\t\tgoto out;\n" - "+\n" - " \tif (atomic_dec_and_test(&md->open_count) &&\n" - " \t (test_bit(DMF_DEFERRED_REMOVE, &md->flags)))\n" - " \t\tqueue_work(deferred_remove_workqueue, &deferred_remove_work);\n" - " \n" - " \tdm_put(md);\n" - "-\n" - "+out:\n" - " \tspin_unlock(&_minor_lock);\n" - " }\n" - " \n" - "@@ -2241,7 +2244,6 @@ static void free_dev(struct mapped_device *md)\n" - " \tint minor = MINOR(disk_devt(md->disk));\n" - " \n" - " \tunlock_fs(md);\n" - "-\tbdput(md->bdev);\n" - " \tdestroy_workqueue(md->wq);\n" - " \n" - " \tif (md->kworker_task)\n" - "@@ -2252,19 +2254,22 @@ static void free_dev(struct mapped_device *md)\n" - " \t\tmempool_destroy(md->rq_pool);\n" - " \tif (md->bs)\n" - " \t\tbioset_free(md->bs);\n" - "-\tblk_integrity_unregister(md->disk);\n" - "-\tdel_gendisk(md->disk);\n" - "+\n" - " \tcleanup_srcu_struct(&md->io_barrier);\n" - " \tfree_table_devices(&md->table_devices);\n" - "-\tfree_minor(minor);\n" - "+\tdm_stats_cleanup(&md->stats);\n" - " \n" - " \tspin_lock(&_minor_lock);\n" - " \tmd->disk->private_data = NULL;\n" - " \tspin_unlock(&_minor_lock);\n" - "-\n" - "+\tif (blk_get_integrity(md->disk))\n" - "+\t\tblk_integrity_unregister(md->disk);\n" - "+\tdel_gendisk(md->disk);\n" - " \tput_disk(md->disk);\n" - " \tblk_cleanup_queue(md->queue);\n" - "-\tdm_stats_cleanup(&md->stats);\n" - "+\tbdput(md->bdev);\n" - "+\tfree_minor(minor);\n" - "+\n" - " \tmodule_put(THIS_MODULE);\n" - " \tkfree(md);\n" - " }\n" - "@@ -2642,8 +2647,9 @@ static void __dm_destroy(struct mapped_device *md, bool wait)\n" - " \n" - " \tmight_sleep();\n" - " \n" - "-\tspin_lock(&_minor_lock);\n" - " \tmap = dm_get_live_table(md, &srcu_idx);\n" - "+\n" - "+\tspin_lock(&_minor_lock);\n" - " \tidr_replace(&_minor_idr, MINOR_ALLOCED, MINOR(disk_devt(dm_disk(md))));\n" - " \tset_bit(DMF_FREEING, &md->flags);\n" - " \tspin_unlock(&_minor_lock);\n" - "-- \n" - 1.7.4.4 + the various DM targets before requesting Linus to pull. -311816cc48e8878af81968a575c3cbb2f6efc83da0e1f044a7fb749f9e1bc4e6 +650c6e947962ec828f5908e075f124ab4cc46ab8262fdf172c77a786b1e54b12
diff --git a/a/1.txt b/N3/1.txt index aeb3bee..4c6acb4 100644 --- a/a/1.txt +++ b/N3/1.txt @@ -32,7 +32,7 @@ Mike Snitzer <snitzer@redhat.com> wrote: FYI, here is the DM fix I've staged for 4.0-rc6. I'll continue testing the various DM targets before requesting Linus to pull. -From 63a4f065ece613b6d575b538234375b0e9c23bbc Mon Sep 17 00:00:00 2001 +>From 63a4f065ece613b6d575b538234375b0e9c23bbc Mon Sep 17 00:00:00 2001 From: Mike Snitzer <snitzer@redhat.com> Date: Mon, 23 Mar 2015 17:01:43 -0400 Subject: [PATCH] dm: fix add_disk() NULL pointer due to race with free_dev() diff --git a/a/content_digest b/N3/content_digest index f644123..b78f7ad 100644 --- a/a/content_digest +++ b/N3/content_digest @@ -51,7 +51,7 @@ "FYI, here is the DM fix I've staged for 4.0-rc6. I'll continue testing\n" "the various DM targets before requesting Linus to pull.\n" "\n" - "From 63a4f065ece613b6d575b538234375b0e9c23bbc Mon Sep 17 00:00:00 2001\n" + ">From 63a4f065ece613b6d575b538234375b0e9c23bbc Mon Sep 17 00:00:00 2001\n" "From: Mike Snitzer <snitzer@redhat.com>\n" "Date: Mon, 23 Mar 2015 17:01:43 -0400\n" "Subject: [PATCH] dm: fix add_disk() NULL pointer due to race with free_dev()\n" @@ -164,4 +164,4 @@ "-- \n" 1.7.4.4 -311816cc48e8878af81968a575c3cbb2f6efc83da0e1f044a7fb749f9e1bc4e6 +c8b1ed72addbcff7cb2889aa0416d3f04a9a0ea1ecae9c79c6968570e7879668
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.