Ming-Hung Tsai
f2893c0804
dm array: fix releasing a faulty array block twice in dm_array_cursor_end
When dm_bm_read_lock() fails due to locking or checksum errors, it
releases the faulty block implicitly while leaving an invalid output
pointer behind. The caller of dm_bm_read_lock() should not operate on
this invalid dm_block pointer, or it will lead to undefined result.
For example, the dm_array_cursor incorrectly caches the invalid pointer
on reading a faulty array block, causing a double release in
dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put().
Reproduce steps:
1. initialize a cache device
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"
dmsetup create cdata --table "0 65536 linear /dev/sdc 8192"
dmsetup create corig --table "0 524288 linear /dev/sdc $262144"
dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1
dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
2. wipe the second array block offline
dmsteup remove cache cmeta cdata corig
mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \
2>/dev/null | hexdump -e '1/8 "%u\n"')
ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \
2>/dev/null | hexdump -e '1/8 "%u\n"')
dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock
3. try reopen the cache device
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"
dmsetup create cdata --table "0 65536 linear /dev/sdc 8192"
dmsetup create corig --table "0 524288 linear /dev/sdc $262144"
dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
Kernel logs:
(snip)
device-mapper: array: array_block_check failed: blocknr 0 != wanted 10
device-mapper: block manager: array validator check failed for block 10
device-mapper: array: get_ablock failed
device-mapper: cache metadata: dm_array_cursor_next for mapping failed
------------[ cut here ]------------
kernel BUG at drivers/md/dm-bufio.c:638!
Fix by setting the cached block pointer to NULL on errors.
In addition to the reproducer described above, this fix can be
verified using the "array_cursor/damaged" test in dm-unit:
dm-unit run /pdata/array_cursor/damaged --kernel-dir <KERNEL_DIR>
Signed-off-by: Ming-Hung Tsai <mtsai@redhat.com>
Fixes: fdd1315aa5 ("dm array: introduce cursor api")
Reviewed-by: Joe Thornber <thornber@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
2024-12-13 08:33:38 -05:00
..
2024-10-30 10:17:00 +01:00
2024-11-06 21:31:36 +01:00
2024-09-04 15:01:17 +01:00
2024-09-11 16:02:45 +02:00
2024-10-24 11:14:00 +02:00
2024-10-02 17:23:23 -04:00
2024-11-06 21:31:36 +01:00
2024-09-10 19:52:30 -05:00
2024-10-18 15:53:00 -07:00
2024-11-12 11:39:12 -05:00
2024-09-27 08:48:37 -07:00
2024-10-17 19:47:15 -06:00
2024-11-13 21:10:45 +02:00
2024-11-10 14:16:28 -08:00
2024-09-17 15:27:01 +02:00
2024-10-02 17:23:23 -04:00
2024-10-02 17:23:23 -04:00
2024-11-11 15:18:41 +01:00
2024-09-18 10:49:45 +02:00
2024-10-16 08:42:54 -07:00
2024-10-25 16:07:03 -05:00
2024-10-09 12:47:19 -07:00
2024-09-05 01:23:56 +09:00
2024-11-03 10:15:50 -10:00
2024-09-19 10:18:15 +02:00
2024-10-05 22:17:08 -05:00
2024-09-26 10:13:08 -07:00
2024-10-27 11:14:35 +09:00
2024-11-15 10:20:17 -08:00
2024-10-02 17:23:23 -04:00
2024-10-02 17:23:23 -04:00
2024-09-27 08:18:43 -07:00
2024-10-31 19:14:17 +01:00
2024-11-17 08:12:48 +10:00
2024-10-02 17:23:23 -04:00
2024-11-06 07:49:54 -10:00
2024-09-19 10:18:15 +02:00
2024-10-14 19:14:08 -07:00
2024-09-27 08:18:43 -07:00
2024-11-08 19:13:06 +01:00
2024-09-17 16:51:45 +02:00
2024-09-25 22:30:33 +02:00
2024-10-24 18:46:04 +01:00
2024-11-12 09:53:11 -05:00
2024-11-03 08:35:29 -10:00
2024-10-15 10:17:54 +02:00
2024-11-07 00:22:44 +01:00
2024-10-02 17:23:23 -04:00
2024-10-02 17:23:23 -04:00
2024-10-02 17:23:23 -04:00
2024-11-12 19:45:25 +01:00
2024-12-13 08:33:38 -05:00
2024-11-08 07:41:27 -10:00
2024-08-31 07:44:24 +02:00
2024-10-02 17:23:23 -04:00
2024-09-29 09:22:34 -07:00
2024-10-02 17:23:23 -04:00
2024-10-29 04:01:40 +01:00
2024-11-12 19:40:40 +01:00
2024-10-02 17:23:23 -04:00
2024-11-14 11:16:28 +01:00
2024-10-02 17:23:23 -04:00
2024-09-20 10:51:25 -04:00
2024-09-26 08:43:17 -07:00
2024-11-09 12:55:32 -08:00
2024-09-26 10:13:08 -07:00
2024-10-10 12:43:01 -05:00
2024-10-02 01:27:50 +02:00
2024-09-09 08:53:17 +02:00
2024-10-13 18:17:35 +02:00
2024-11-01 15:44:23 -10:00
2024-10-02 17:23:23 -04:00
2024-10-02 17:23:23 -04:00
2024-11-12 07:34:27 -08:00
2024-10-21 23:34:42 +05:30
2024-10-12 22:04:38 +02:00
2024-11-06 08:03:19 -10:00
2024-11-01 12:53:16 +01:00
2024-10-02 17:23:23 -04:00
2024-10-21 13:23:06 +02:00
2024-09-27 08:18:43 -07:00
2024-10-02 17:23:23 -04:00
2024-10-25 11:29:17 +02:00
2024-11-01 14:47:08 +00:00
2024-09-29 09:53:04 -07:00
2024-09-30 14:24:37 +02:00
2024-10-24 13:03:37 -05:00
2024-10-02 17:23:23 -04:00
2024-10-16 11:32:32 +02:00
2024-09-27 08:18:43 -07:00
2024-11-08 09:56:27 -10:00
2024-09-26 17:25:29 +02:00
2024-09-03 12:10:38 +02:00
2024-11-04 14:23:09 +01:00
2024-10-17 12:11:19 +01:00
2024-10-23 22:37:54 +01:00
2024-11-10 08:53:24 -08:00
2024-10-19 12:52:19 -07:00
2024-09-09 12:22:06 +02:00
2024-11-04 15:38:29 +01:00
2024-11-07 16:11:57 +01:00
2024-10-11 08:39:24 +02:00
2024-11-08 09:56:27 -10:00
2024-09-11 16:02:54 +02:00
2024-11-08 08:36:31 +01:00
2024-11-12 18:05:04 -05:00
2024-09-27 08:18:43 -07:00
2024-10-07 11:33:26 -07:00
2024-10-21 11:16:51 +02:00
2024-09-27 08:18:43 -07:00
2024-11-06 04:40:07 -05:00
2024-09-06 19:18:32 +02:00
2024-10-02 17:23:23 -04:00
2024-10-18 11:59:04 +02:00
2024-09-04 17:24:58 -05:00