lkml.org 
[lkml]   [2012]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 134/187] dm persistent data: handle space map checker creation failure
    Date
    From: Greg KH <gregkh@linuxfoundation.org>

    3.4-stable review patch. If anyone has any objections, please let me know.

    ------------------

    From: Mike Snitzer <snitzer@redhat.com>

    commit 62662303e7f590fdfbb0070ab820a0ad4267c119 upstream.

    If CONFIG_DM_DEBUG_SPACE_MAPS is enabled and dm_sm_checker_create()
    fails, dm_tm_create_internal() would still return success even though it
    cleaned up all resources it was supposed to have created. This will
    lead to a kernel crash:

    general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
    ...
    RIP: 0010:[<ffffffff81593659>] [<ffffffff81593659>] dm_bufio_get_block_size+0x9/0x20
    Call Trace:
    [<ffffffff81599bae>] dm_bm_block_size+0xe/0x10
    [<ffffffff8159b8b8>] sm_ll_init+0x78/0xd0
    [<ffffffff8159c1a6>] sm_ll_new_disk+0x16/0xa0
    [<ffffffff8159c98e>] dm_sm_disk_create+0xfe/0x160
    [<ffffffff815abf6e>] dm_pool_metadata_open+0x16e/0x6a0
    [<ffffffff815aa010>] pool_ctr+0x3f0/0x900
    [<ffffffff8158d565>] dm_table_add_target+0x195/0x450
    [<ffffffff815904c4>] table_load+0xe4/0x330
    [<ffffffff815917ea>] ctl_ioctl+0x15a/0x2c0
    [<ffffffff81591963>] dm_ctl_ioctl+0x13/0x20
    [<ffffffff8116a4f8>] do_vfs_ioctl+0x98/0x560
    [<ffffffff8116aa51>] sys_ioctl+0x91/0xa0
    [<ffffffff81869f52>] system_call_fastpath+0x16/0x1b

    Fix the space map checker code to return an appropriate ERR_PTR and have
    dm_sm_disk_create() and dm_tm_create_internal() check for it with
    IS_ERR.

    Reported-by: Vivek Goyal <vgoyal@redhat.com>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    Signed-off-by: Alasdair G Kergon <agk@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/md/persistent-data/dm-space-map-checker.c | 24 ++++++++++----------
    drivers/md/persistent-data/dm-space-map-disk.c | 11 ++++++++-
    drivers/md/persistent-data/dm-transaction-manager.c | 8 +++++-
    3 files changed, 28 insertions(+), 15 deletions(-)

    --- a/drivers/md/persistent-data/dm-space-map-checker.c
    +++ b/drivers/md/persistent-data/dm-space-map-checker.c
    @@ -343,25 +343,25 @@ struct dm_space_map *dm_sm_checker_creat
    int r;
    struct sm_checker *smc;

    - if (!sm)
    - return NULL;
    + if (IS_ERR_OR_NULL(sm))
    + return ERR_PTR(-EINVAL);

    smc = kmalloc(sizeof(*smc), GFP_KERNEL);
    if (!smc)
    - return NULL;
    + return ERR_PTR(-ENOMEM);

    memcpy(&smc->sm, &ops_, sizeof(smc->sm));
    r = ca_create(&smc->old_counts, sm);
    if (r) {
    kfree(smc);
    - return NULL;
    + return ERR_PTR(r);
    }

    r = ca_create(&smc->counts, sm);
    if (r) {
    ca_destroy(&smc->old_counts);
    kfree(smc);
    - return NULL;
    + return ERR_PTR(r);
    }

    smc->real_sm = sm;
    @@ -371,7 +371,7 @@ struct dm_space_map *dm_sm_checker_creat
    ca_destroy(&smc->counts);
    ca_destroy(&smc->old_counts);
    kfree(smc);
    - return NULL;
    + return ERR_PTR(r);
    }

    r = ca_commit(&smc->old_counts, &smc->counts);
    @@ -379,7 +379,7 @@ struct dm_space_map *dm_sm_checker_creat
    ca_destroy(&smc->counts);
    ca_destroy(&smc->old_counts);
    kfree(smc);
    - return NULL;
    + return ERR_PTR(r);
    }

    return &smc->sm;
    @@ -391,25 +391,25 @@ struct dm_space_map *dm_sm_checker_creat
    int r;
    struct sm_checker *smc;

    - if (!sm)
    - return NULL;
    + if (IS_ERR_OR_NULL(sm))
    + return ERR_PTR(-EINVAL);

    smc = kmalloc(sizeof(*smc), GFP_KERNEL);
    if (!smc)
    - return NULL;
    + return ERR_PTR(-ENOMEM);

    memcpy(&smc->sm, &ops_, sizeof(smc->sm));
    r = ca_create(&smc->old_counts, sm);
    if (r) {
    kfree(smc);
    - return NULL;
    + return ERR_PTR(r);
    }

    r = ca_create(&smc->counts, sm);
    if (r) {
    ca_destroy(&smc->old_counts);
    kfree(smc);
    - return NULL;
    + return ERR_PTR(r);
    }

    smc->real_sm = sm;
    --- a/drivers/md/persistent-data/dm-space-map-disk.c
    +++ b/drivers/md/persistent-data/dm-space-map-disk.c
    @@ -290,7 +290,16 @@ struct dm_space_map *dm_sm_disk_create(s
    dm_block_t nr_blocks)
    {
    struct dm_space_map *sm = dm_sm_disk_create_real(tm, nr_blocks);
    - return dm_sm_checker_create_fresh(sm);
    + struct dm_space_map *smc;
    +
    + if (IS_ERR_OR_NULL(sm))
    + return sm;
    +
    + smc = dm_sm_checker_create_fresh(sm);
    + if (IS_ERR(smc))
    + dm_sm_destroy(sm);
    +
    + return smc;
    }
    EXPORT_SYMBOL_GPL(dm_sm_disk_create);

    --- a/drivers/md/persistent-data/dm-transaction-manager.c
    +++ b/drivers/md/persistent-data/dm-transaction-manager.c
    @@ -345,8 +345,10 @@ static int dm_tm_create_internal(struct
    }

    *sm = dm_sm_checker_create(inner);
    - if (!*sm)
    + if (IS_ERR(*sm)) {
    + r = PTR_ERR(*sm);
    goto bad2;
    + }

    } else {
    r = dm_bm_write_lock(dm_tm_get_bm(*tm), sb_location,
    @@ -365,8 +367,10 @@ static int dm_tm_create_internal(struct
    }

    *sm = dm_sm_checker_create(inner);
    - if (!*sm)
    + if (IS_ERR(*sm)) {
    + r = PTR_ERR(*sm);
    goto bad2;
    + }
    }

    return 0;



    \
     
     \ /
      Last update: 2012-07-13 02:21    [W:3.316 / U:0.196 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site