panic&nb= sp;call trace:
PID: 25992 TASK: ffff883cd7d23= 500 CPU: 4 COMMAND: "vgchange"
  #0 = [ffff883cd743d600] machine_kexec at ffffffff81038fa9
&nb= sp; 0000001 [ffff883cd743d660] crash_kexec at fff= fffff810c5992
  0000002 [ffff883cd743d730] oops_end= at ffffffff81515c90
  0000003 [ffff883cd743d7= 60] no_context at ffffffff81049f1b
  0000004&n= bsp;[ffff883cd743d7b0] __bad_area_nosemaphore at ffffffff81= 04a1a5
  0000005 [ffff883cd743d800] bad_area a= t ffffffff8104a2ce
  0000006 [ffff883cd743d830]&nbs= p;__do_page_fault at ffffffff8104aa6f
  0000007&nbs= p;[ffff883cd743d950] do_page_fault at ffffffff81517bae
&= nbsp; 0000008 [ffff883cd743d980] page_fault at ff= ffffff81514f95
     [exception RIP: = kmem_cache_alloc+108]
     RIP: ffffffff8= 116ef3c RSP: ffff883cd743da38 RFLAGS: 00010046
&nbs= p;    RAX: 0000000000000004 RBX: ffffff= ff81121b90 RCX: ffff881bf1e78cc0
    &nbs= p;RDX: 0000000000000000 RSI: 00000000000000d0 RDI:&nbs= p;0000000000000000
     RBP: ffff883cd743= da68 R8: ffff881bf1a4eb00 R9: 0000000080042000
&nbs= p;    R10: 0000000000002000 R11: 000000= 0000000000 R12: 00000000000000d0
    &nbs= p;R13: 0000000000000000 R14: 00000000000000d0 R15:&nbs= p;0000000000000246
     ORIG_RAX: fffffff= fffffffff CS: 0010 SS: 0018
  0000009&nbs= p;[ffff883cd743da70] mempool_alloc_slab at ffffffff81121ba5=
0000010 [ffff883cd743da80] mempool_create_node at= ffffffff81122083
0000011 [ffff883cd743dad0] mempo= ol_create at ffffffff811220f4
0000012 [ffff883cd74= 3dae0] pool_ctr at ffffffffa08de049 [dm_thin_pool]
= 0000013 [ffff883cd743dbd0] dm_table_add_target at&nbs= p;ffffffffa0005f2f [dm_mod]
0000014 [ffff883cd743dc30]&= nbsp;table_load at ffffffffa0008ba9 [dm_mod]
00000= 15 [ffff883cd743dc90] ctl_ioctl at ffffffffa0009dc4&nb= sp;[dm_mod]
this bug's scence is as foll= ows:
process A(vgchange -ay -K):
a. send DM_LIST_VERSIONS_CMD&n= bsp;ioctl;
b. pool= _target not registered;
c. modprobe dm_thin_pool and wait unti= l end.
process B(vgchange -ay -K):
<= span style=3D"white-space: pre;"> a. send DM_LIST_VERSION= S_CMD ioctl;
b.&nb= sp;pool_target registered;
c. table_load->dm_table_add_target->pool_ctr;
= ; d. _new_mapping_cache = ;is NULL and panic.
note:
1. process A and process&nb= sp;B are two concurrent processes.
2. pool_target can be = detected by process B but
_new_mapping_cache initialization has&nbs= p;not ended.
All that we need do is= to ensure pool_target registering ops
i= s the last ops in dm_thin_init.

Signed-off= -by: monty <monty_pavel@sina.com>
---
drivers/= md/dm-thin.c |   22 ++++++++++------------
&nb= sp;1 files changed, 10 insertions(+), 12 del= etions(-)

diff --git a/drivers/md/dm-thin.c b/driver= s/md/dm-thin.c
index 89e5dff..f91d771 100644
--- a/dr= ivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -4355,30&= nbsp;+4355,28 @@ static void thin_io_hints(struct = ;dm_target *ti, struct queue_limits *limits)
=
static int __init dm_thin_init(void)
{- int r;
+ int r =3D -ENOMEM;
=
pool_table_init();
=
+ _new_mapping_cache&nb= sp;=3D KMEM_CACHE(dm_thin_new_mapping, 0);
+ if (!_new_mapping_cache)
+ retur= n r;
+
r = =3D dm_register_target(&thin_target);
if (r)
-= return r;
+ goto bad_new_mapping_cache;

r =3D dm_register_target(&pool_targ= et);
if (r)
- = goto bad_pool_target;
-
- r =3D -ENOMEM;
-
- _new_mapping_cache =3D KMEM_CACHE(dm_thin_new_mapp= ing, 0);
- if (!_new= _mapping_cache)
- goto bad_new_mapping_cache;
+ goto bad_thin_target;

return 0;

-bad_new_mapping_cache:
-= dm_unregister_target(&pool_t= arget);
-bad_pool_target:
+bad_thin_target:
dm_unregister_target(&thin_target);
+bad= _new_mapping_cache:
+ kmem_cac= he_destroy(_new_mapping_cache);

return r;
}
--
1.7.1=0A ------=_001_NextPart652568046867_=------ --===============8760186108281885390== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============8760186108281885390==--