From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x227an6WuUfuGxNbcQuQbXkMsAQpZe/DRjj9Yt9Ud8CqG44zvPHRsrGY3/xYR3RpDqrW6k7uu ARC-Seal: i=1; a=rsa-sha256; t=1516611202; cv=none; d=google.com; s=arc-20160816; b=Jcpe50r33HiYd01fJaVTNBK1SVXE5mFLwUhaMWQ5Voj6AzO4J0Y8OKLTFOuWsYL4RW 7rKWOw0Nlanar29uKTdU8vevbSJAXrsDRLDr+4u4jKzvtRDL+Sm4SN8K6a7E4W1CFsMa boODXbY1aaO0C9s5srNT5u1iabilPvMQ3RM/ojUGLd9DBpGnvkqHpllwVnucbvlj44Dp jYvn+NQHrUNXiRiW5CPSBCSAzgtKo1V2Zc9vyeQZjVf+26sH9zhSlwmR1tn5/LPgoDwd vIXn4PJqDfKQzqNmWMLnOvDgE2MFTWS5wSOaYxox/w8a861T/rRuFkE1ZAbf0qQ5GJIA ut4Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=JyU4aY3Q/lezNN0h1ruxhxcy/7JriuYnx4w0xPLwhGA=; b=FCKTOIdjjNHN5wmOiyJj5nc5AgmcgsUB8fHkJ56D0E2Ftwkn0SY+damf6b5ozT7zdi 3pDby34VEyaosYMgm9x19Xh/mvJ9TRFRuxRsxZRTbRU01381GnZtfUBs5xYMMqbe5eJO nHvVEDjemhg+CVknYVfVTrm/ko1q/IERZw07XfFhGQublxHys6XbVWEnkewY5VWPD7oP +DHwbNDGUL8kx2EHCITinYpsc7qsxPUGTfb2tELtrDIvCKqV+7V9RNcUgv/Ij6s+tFun a6jlQ3T8V8X0KH4i/32Cv9BMDzwXcKs6pUY+IOLOUnWvo+MfEruRLArFT0dIk7D/0NwI B1qg== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Monty Pavel , Joe Thornber , Mike Snitzer Subject: [PATCH 4.14 70/89] dm btree: fix serious bug in btree_split_beneath() Date: Mon, 22 Jan 2018 09:45:50 +0100 Message-Id: <20180122084001.437618253@linuxfoundation.org> X-Mailer: git-send-email 2.16.0 In-Reply-To: <20180122083954.683903493@linuxfoundation.org> References: <20180122083954.683903493@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590281422090632724?= X-GMAIL-MSGID: =?utf-8?q?1590282107985391407?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joe Thornber commit bc68d0a43560e950850fc69b58f0f8254b28f6d6 upstream. When inserting a new key/value pair into a btree we walk down the spine of btree nodes performing the following 2 operations: i) space for a new entry ii) adjusting the first key entry if the new key is lower than any in the node. If the _root_ node is full, the function btree_split_beneath() allocates 2 new nodes, and redistibutes the root nodes entries between them. The root node is left with 2 entries corresponding to the 2 new nodes. btree_split_beneath() then adjusts the spine to point to one of the two new children. This means the first key is never adjusted if the new key was lower, ie. operation (ii) gets missed out. This can result in the new key being 'lost' for a period; until another low valued key is inserted that will uncover it. This is a serious bug, and quite hard to make trigger in normal use. A reproducing test case ("thin create devices-in-reverse-order") is available as part of the thin-provision-tools project: https://github.com/jthornber/thin-provisioning-tools/blob/master/functional-tests/device-mapper/dm-tests.scm#L593 Fix the issue by changing btree_split_beneath() so it no longer adjusts the spine. Instead it unlocks both the new nodes, and lets the main loop in btree_insert_raw() relock the appropriate one and make any neccessary adjustments. Reported-by: Monty Pavel Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman --- drivers/md/persistent-data/dm-btree.c | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) --- a/drivers/md/persistent-data/dm-btree.c +++ b/drivers/md/persistent-data/dm-btree.c @@ -683,23 +683,8 @@ static int btree_split_beneath(struct sh pn->keys[1] = rn->keys[0]; memcpy_disk(value_ptr(pn, 1), &val, sizeof(__le64)); - /* - * rejig the spine. This is ugly, since it knows too - * much about the spine - */ - if (s->nodes[0] != new_parent) { - unlock_block(s->info, s->nodes[0]); - s->nodes[0] = new_parent; - } - if (key < le64_to_cpu(rn->keys[0])) { - unlock_block(s->info, right); - s->nodes[1] = left; - } else { - unlock_block(s->info, left); - s->nodes[1] = right; - } - s->count = 2; - + unlock_block(s->info, left); + unlock_block(s->info, right); return 0; }